Edit tour

Linux Analysis Report
demon.x86.elf

Overview

General Information

Sample name:	demon.x86.elf
Analysis ID:	1635800
MD5:	accf5b6999867c3bbe5ac612359a58a3
SHA1:	f66a5013f5358dec0e6cbe70772005b8306691d6
SHA256:	0f64a21801c7dd5100ad03f64dce5be2f0a80b1953bda6c2e6a9f0b90f9be5b4
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635800
Start date and time:	2025-03-12 01:17:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	demon.x86.elf
Detection:	MAL
Classification:	mal68.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/demon.x86.elf
PID:	6252
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Dark Qbot Variant Executed.
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6225, Parent: 4331)

rm (PID: 6225, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR

dash New Fork (PID: 6226, Parent: 4331)

rm (PID: 6226, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR

demon.x86.elf (PID: 6252, Parent: 6154, MD5: accf5b6999867c3bbe5ac612359a58a3) Arguments: /tmp/demon.x86.elf

demon.x86.elf New Fork (PID: 6253, Parent: 6252)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
demon.x86.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x2d27:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
demon.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb72:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3ebc:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
demon.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x4bae:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
demon.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x28e7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
demon.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x2bb2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48

Memory Dumps

Source	Rule	Description	Author	Strings
6252.1.0000000000400000.0000000000407000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x2d27:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6252.1.0000000000400000.0000000000407000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb72:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x3ebc:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6252.1.0000000000400000.0000000000407000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x4bae:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6252.1.0000000000400000.0000000000407000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x28e7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6252.1.0000000000400000.0000000000407000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x2bb2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-12T01:17:59.837436+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47588	196.251.81.246	39	TCP
2025-03-12T01:18:01.473434+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47590	196.251.81.246	39	TCP
2025-03-12T01:18:03.093632+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47592	196.251.81.246	39	TCP
2025-03-12T01:18:04.724749+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47594	196.251.81.246	39	TCP
2025-03-12T01:18:06.366627+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47596	196.251.81.246	39	TCP
2025-03-12T01:18:08.029593+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47598	196.251.81.246	39	TCP
2025-03-12T01:18:09.656255+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47600	196.251.81.246	39	TCP
2025-03-12T01:18:11.285558+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47602	196.251.81.246	39	TCP
2025-03-12T01:18:12.913679+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47604	196.251.81.246	39	TCP
2025-03-12T01:18:14.554467+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47606	196.251.81.246	39	TCP
2025-03-12T01:18:16.193285+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47608	196.251.81.246	39	TCP
2025-03-12T01:18:17.834696+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47610	196.251.81.246	39	TCP
2025-03-12T01:18:19.455550+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47612	196.251.81.246	39	TCP
2025-03-12T01:18:21.097274+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47614	196.251.81.246	39	TCP
2025-03-12T01:18:22.748024+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47616	196.251.81.246	39	TCP
2025-03-12T01:18:24.381364+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47618	196.251.81.246	39	TCP
2025-03-12T01:18:26.020882+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47620	196.251.81.246	39	TCP
2025-03-12T01:18:27.662817+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47622	196.251.81.246	39	TCP
2025-03-12T01:18:29.316483+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47624	196.251.81.246	39	TCP
2025-03-12T01:18:30.957147+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47626	196.251.81.246	39	TCP
2025-03-12T01:18:32.599130+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47628	196.251.81.246	39	TCP
2025-03-12T01:18:34.221333+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47630	196.251.81.246	39	TCP
2025-03-12T01:18:35.864185+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47632	196.251.81.246	39	TCP
2025-03-12T01:18:37.487005+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47634	196.251.81.246	39	TCP
2025-03-12T01:18:39.163987+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47636	196.251.81.246	39	TCP
2025-03-12T01:18:40.805353+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47638	196.251.81.246	39	TCP
2025-03-12T01:18:42.429309+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47640	196.251.81.246	39	TCP
2025-03-12T01:18:44.047249+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47642	196.251.81.246	39	TCP
2025-03-12T01:18:45.677539+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47644	196.251.81.246	39	TCP
2025-03-12T01:18:47.301097+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47646	196.251.81.246	39	TCP
2025-03-12T01:18:48.924378+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47648	196.251.81.246	39	TCP
2025-03-12T01:18:50.547684+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47650	196.251.81.246	39	TCP
2025-03-12T01:18:52.173120+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47652	196.251.81.246	39	TCP
2025-03-12T01:18:53.800200+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47654	196.251.81.246	39	TCP
2025-03-12T01:18:55.424489+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47656	196.251.81.246	39	TCP
2025-03-12T01:18:57.074884+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47658	196.251.81.246	39	TCP
2025-03-12T01:18:58.714025+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47660	196.251.81.246	39	TCP
2025-03-12T01:19:00.346681+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47662	196.251.81.246	39	TCP
2025-03-12T01:19:02.001013+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47664	196.251.81.246	39	TCP
2025-03-12T01:19:03.631055+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47666	196.251.81.246	39	TCP
2025-03-12T01:19:05.255351+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47668	196.251.81.246	39	TCP
2025-03-12T01:19:06.883700+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47670	196.251.81.246	39	TCP
2025-03-12T01:19:08.530170+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47672	196.251.81.246	39	TCP
2025-03-12T01:19:10.161948+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47674	196.251.81.246	39	TCP
2025-03-12T01:19:11.811241+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47676	196.251.81.246	39	TCP
2025-03-12T01:19:13.447543+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47678	196.251.81.246	39	TCP
2025-03-12T01:19:15.064942+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47680	196.251.81.246	39	TCP
2025-03-12T01:19:16.713351+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47682	196.251.81.246	39	TCP
2025-03-12T01:19:18.375418+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47684	196.251.81.246	39	TCP
2025-03-12T01:19:20.007153+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47686	196.251.81.246	39	TCP
2025-03-12T01:19:21.627651+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47688	196.251.81.246	39	TCP
2025-03-12T01:19:23.273344+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47690	196.251.81.246	39	TCP
2025-03-12T01:19:24.916346+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47692	196.251.81.246	39	TCP
2025-03-12T01:19:26.551261+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47694	196.251.81.246	39	TCP
2025-03-12T01:19:28.176368+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47696	196.251.81.246	39	TCP
2025-03-12T01:19:29.819274+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47698	196.251.81.246	39	TCP
2025-03-12T01:19:31.442181+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47700	196.251.81.246	39	TCP
2025-03-12T01:19:33.087172+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47702	196.251.81.246	39	TCP
2025-03-12T01:19:34.811203+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47704	196.251.81.246	39	TCP
2025-03-12T01:19:36.448291+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47706	196.251.81.246	39	TCP
2025-03-12T01:19:38.087318+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47708	196.251.81.246	39	TCP
2025-03-12T01:19:39.727288+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47710	196.251.81.246	39	TCP
2025-03-12T01:19:41.364356+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47712	196.251.81.246	39	TCP
2025-03-12T01:19:43.011967+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47714	196.251.81.246	39	TCP
2025-03-12T01:19:44.627101+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47716	196.251.81.246	39	TCP
2025-03-12T01:19:46.272472+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47718	196.251.81.246	39	TCP
2025-03-12T01:19:47.899963+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47720	196.251.81.246	39	TCP
2025-03-12T01:19:49.518727+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47722	196.251.81.246	39	TCP
2025-03-12T01:19:51.167425+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47724	196.251.81.246	39	TCP
2025-03-12T01:19:52.840339+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47726	196.251.81.246	39	TCP
2025-03-12T01:19:54.472815+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47728	196.251.81.246	39	TCP
2025-03-12T01:19:56.116662+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47730	196.251.81.246	39	TCP
2025-03-12T01:19:57.739378+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47732	196.251.81.246	39	TCP
2025-03-12T01:19:59.388131+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47734	196.251.81.246	39	TCP
2025-03-12T01:20:01.019245+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47736	196.251.81.246	39	TCP
2025-03-12T01:20:02.663531+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47738	196.251.81.246	39	TCP
2025-03-12T01:20:04.303373+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47740	196.251.81.246	39	TCP
2025-03-12T01:20:05.925527+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47742	196.251.81.246	39	TCP
2025-03-12T01:20:07.556938+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47744	196.251.81.246	39	TCP
2025-03-12T01:20:09.175312+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47746	196.251.81.246	39	TCP
2025-03-12T01:20:10.807617+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47748	196.251.81.246	39	TCP
2025-03-12T01:20:12.443825+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47750	196.251.81.246	39	TCP
2025-03-12T01:20:14.081636+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47752	196.251.81.246	39	TCP
2025-03-12T01:20:15.708641+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47754	196.251.81.246	39	TCP
2025-03-12T01:20:17.339313+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47756	196.251.81.246	39	TCP
2025-03-12T01:20:18.977973+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47758	196.251.81.246	39	TCP
2025-03-12T01:20:20.641256+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47760	196.251.81.246	39	TCP
2025-03-12T01:20:22.268346+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47762	196.251.81.246	39	TCP
2025-03-12T01:20:23.896169+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47764	196.251.81.246	39	TCP
2025-03-12T01:20:25.541021+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47766	196.251.81.246	39	TCP
2025-03-12T01:20:27.160766+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47768	196.251.81.246	39	TCP
2025-03-12T01:20:28.803343+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47770	196.251.81.246	39	TCP
2025-03-12T01:20:30.449111+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47772	196.251.81.246	39	TCP
2025-03-12T01:20:32.090075+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47774	196.251.81.246	39	TCP
2025-03-12T01:20:33.743088+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47776	196.251.81.246	39	TCP
2025-03-12T01:20:35.405975+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47778	196.251.81.246	39	TCP
2025-03-12T01:20:37.055021+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47780	196.251.81.246	39	TCP
2025-03-12T01:20:38.702167+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47782	196.251.81.246	39	TCP
2025-03-12T01:20:40.334422+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47784	196.251.81.246	39	TCP
2025-03-12T01:20:41.984790+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47786	196.251.81.246	39	TCP
2025-03-12T01:20:43.623180+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47788	196.251.81.246	39	TCP
2025-03-12T01:20:45.237458+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47790	196.251.81.246	39	TCP
2025-03-12T01:20:46.891976+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47792	196.251.81.246	39	TCP
2025-03-12T01:20:48.522203+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47794	196.251.81.246	39	TCP
2025-03-12T01:20:50.144851+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47796	196.251.81.246	39	TCP
2025-03-12T01:20:51.768989+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47798	196.251.81.246	39	TCP
2025-03-12T01:20:53.395208+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47800	196.251.81.246	39	TCP
2025-03-12T01:20:55.043516+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47802	196.251.81.246	39	TCP
2025-03-12T01:20:56.660858+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47804	196.251.81.246	39	TCP
2025-03-12T01:20:58.292143+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47806	196.251.81.246	39	TCP
2025-03-12T01:20:59.938525+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47808	196.251.81.246	39	TCP
2025-03-12T01:21:01.575009+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47810	196.251.81.246	39	TCP
2025-03-12T01:21:03.208607+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47812	196.251.81.246	39	TCP
2025-03-12T01:21:04.835451+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47814	196.251.81.246	39	TCP
2025-03-12T01:21:06.458997+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47816	196.251.81.246	39	TCP
2025-03-12T01:21:08.098941+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47818	196.251.81.246	39	TCP
2025-03-12T01:21:09.731093+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47820	196.251.81.246	39	TCP
2025-03-12T01:21:11.371942+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47822	196.251.81.246	39	TCP
2025-03-12T01:21:13.013608+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47824	196.251.81.246	39	TCP
2025-03-12T01:21:14.649203+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47826	196.251.81.246	39	TCP
2025-03-12T01:21:16.276857+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47828	196.251.81.246	39	TCP
2025-03-12T01:21:17.916912+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47830	196.251.81.246	39	TCP
2025-03-12T01:21:19.572348+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47832	196.251.81.246	39	TCP
2025-03-12T01:21:21.192796+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47834	196.251.81.246	39	TCP
2025-03-12T01:21:22.837335+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47836	196.251.81.246	39	TCP
2025-03-12T01:21:24.484739+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47838	196.251.81.246	39	TCP
2025-03-12T01:21:26.118866+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47840	196.251.81.246	39	TCP
2025-03-12T01:21:27.785220+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47842	196.251.81.246	39	TCP
2025-03-12T01:21:29.417562+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47844	196.251.81.246	39	TCP
2025-03-12T01:21:31.087742+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47846	196.251.81.246	39	TCP
2025-03-12T01:21:32.735318+0100	2839492	1	Malware Command and Control Activity Detected	192.168.2.23	47848	196.251.81.246	39	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: demon.x86.elf	Virustotal: Detection: 12%			Perma Link
Source: demon.x86.elf	ReversingLabs: Detection: 18%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47616 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47610 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47620 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47630 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47604 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47590 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47710 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47664 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47598 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47588 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47592 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47614 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47612 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47638 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47634 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47608 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47666 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47738 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47662 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47606 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47658 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47692 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47766 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47626 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47720 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47708 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47680 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47822 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47788 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47830 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47794 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47622 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47818 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47648 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47642 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47636 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47602 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47802 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47628 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47640 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47796 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47676 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47694 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47670 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47836 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47682 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47650 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47688 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47806 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47716 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47702 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47660 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47790 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47804 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47746 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47632 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47644 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47718 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47722 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47684 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47758 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47756 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47600 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47814 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47724 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47646 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47844 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47728 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47652 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47742 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47840 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47624 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47764 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47618 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47596 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47740 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47594 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47774 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47748 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47736 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47762 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47838 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47752 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47654 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47690 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47696 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47700 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47714 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47820 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47744 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47706 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47656 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47768 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47674 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47750 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47678 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47730 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47754 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47828 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47792 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47760 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47672 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47712 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47726 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47668 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47786 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47832 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47834 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47778 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47810 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47772 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47812 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47686 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47808 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47848 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47798 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47776 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47704 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47780 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47816 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47826 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47782 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47842 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47800 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47770 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47698 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47734 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47732 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47784 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47824 -> 196.251.81.246:39
Source: Network traffic	Suricata IDS: 2839492 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3 : 192.168.2.23:47846 -> 196.251.81.246:39

Source: global traffic

TCP traffic: 192.168.2.23:47588 -> 196.251.81.246:39

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.81.246

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: demon.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6252.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.evad.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6225)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR			Jump to behavior
Source: /usr/bin/dash (PID: 6226)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/demon.x86.elf (PID: 6252)

File: /tmp/demon.x86.elf

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 File Deletion	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
demon.x86.elf	12%	Virustotal		Browse
demon.x86.elf	18%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
196.251.81.246	unknown	Seychelles	37417	SONIC-WirelessZA	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	sh4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	morte.x64.elf	Get hash	malicious	Unknown	Browse
	hide.sh4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	59.88.34.221-bin.sh-2025-03-11T04_09_49.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
196.251.81.246	demon.mips.elf	Get hash	malicious	Unknown	Browse
	demon.arm.elf	Get hash	malicious	Unknown	Browse
	demon.mpsl.elf	Get hash	malicious	Unknown	Browse
	demon.arm.elf	Get hash	malicious	Unknown	Browse
	demon.mpsl.elf	Get hash	malicious	Unknown	Browse
	demon.mips.elf	Get hash	malicious	Unknown	Browse
	demon.x86.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	demon.mips.elf	Get hash	malicious	Unknown	Browse
	demon.arm7.elf	Get hash	malicious	Unknown	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.m68k.elf	Get hash	malicious	Unknown	Browse
	morte.spc.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	demon.mips.elf	Get hash	malicious	Unknown	Browse
	demon.arm7.elf	Get hash	malicious	Unknown	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.m68k.elf	Get hash	malicious	Unknown	Browse
	morte.spc.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SONIC-WirelessZA	demon.mips.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.arm.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.mpsl.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.arm.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.mpsl.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.mips.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	demon.x86.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	Global e-Banking Payment Advice 000000164.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222
	P.Order request for quotations.exe	Get hash	malicious	FormBook	Browse	196.251.83.222
	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	196.251.83.222
CANONICAL-ASGB	demon.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	demon.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.mips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	demon.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	demon.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.mips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
AMAZON-02US	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.canva.com/design/DAGhb8U4chg/3aIOcMOYfXFvNu6pkMJtcA/view?utm_content=DAGhb8U4chg&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=he54ee766c5	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	54.171.122.26
	na.elf	Get hash	malicious	Prometei	Browse	34.219.59.42
	na.elf	Get hash	malicious	Prometei	Browse	34.219.59.42
	https://aid97400.lautre.net/spip.php?action=cookie&url=https://gamma.app/docs/Incoming-PDF-Document-s6fqj764y4eavtn?mode=present#card-n5or5ilh0b5ihtz	Get hash	malicious	HTMLPhisher	Browse	76.223.31.44
	https://rebrand.ly/1bbw71e	Get hash	malicious	HTMLPhisher	Browse	18.245.31.78
	na.elf	Get hash	malicious	Prometei	Browse	34.219.59.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==	Get hash	malicious	Unknown	Browse	35.166.139.108
	sh4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
INIT7CH	demon.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	demon.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.spc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.122709820506521
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	demon.x86.elf
File size:	30'240 bytes
MD5:	accf5b6999867c3bbe5ac612359a58a3
SHA1:	f66a5013f5358dec0e6cbe70772005b8306691d6
SHA256:	0f64a21801c7dd5100ad03f64dce5be2f0a80b1953bda6c2e6a9f0b90f9be5b4
SHA512:	6651ec5b7ee08e62f7069871ea05da352dd62a4d93060bd33309027fde160911b7d78b3c0130d45431b993b2f2b15f559405b07e03b9f38bae4a153c3918426f
SSDEEP:	384:lqlYfzfyXD6utxw7GIYxpZz3n6UGTXRLQfsQlRJXWv873FqRkO3WDon+ePA:lfb8D6uZIYx+U4UfsQlRd5738k8+IA
TLSH:	1ED26F236440C0FCCCDAC1B58BD6AD29B733B4391392B26473D8FA265EAEF505E5952C
File Content Preview:	.ELF..............>.......@.....@........s..........@.8...@.......................@.......@......m.......m.......................p.......pP......pP.....`........+..............Q.td....................................................H...._.....Q..H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	29600
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x5206	0x0	0x6	AX	16
.fini	PROGBITS	0x405306	0x5306	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x405320	0x5320	0x1ab0	0x0	0x2	A	32
.ctors	PROGBITS	0x507000	0x7000	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x507010	0x7010	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x507040	0x7040	0x320	0x0	0x3	WA	32
.bss	NOBITS	0x507360	0x7360	0x2868	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x7360	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x6dd0	0x6dd0	6.3660	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x7000	0x507000	0x507000	0x360	0x2bc8	1.0078	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-12T01:17:59.837436+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47588	196.251.81.246	39	TCP
2025-03-12T01:18:01.473434+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47590	196.251.81.246	39	TCP
2025-03-12T01:18:03.093632+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47592	196.251.81.246	39	TCP
2025-03-12T01:18:04.724749+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47594	196.251.81.246	39	TCP
2025-03-12T01:18:06.366627+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47596	196.251.81.246	39	TCP
2025-03-12T01:18:08.029593+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47598	196.251.81.246	39	TCP
2025-03-12T01:18:09.656255+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47600	196.251.81.246	39	TCP
2025-03-12T01:18:11.285558+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47602	196.251.81.246	39	TCP
2025-03-12T01:18:12.913679+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47604	196.251.81.246	39	TCP
2025-03-12T01:18:14.554467+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47606	196.251.81.246	39	TCP
2025-03-12T01:18:16.193285+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47608	196.251.81.246	39	TCP
2025-03-12T01:18:17.834696+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47610	196.251.81.246	39	TCP
2025-03-12T01:18:19.455550+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47612	196.251.81.246	39	TCP
2025-03-12T01:18:21.097274+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47614	196.251.81.246	39	TCP
2025-03-12T01:18:22.748024+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47616	196.251.81.246	39	TCP
2025-03-12T01:18:24.381364+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47618	196.251.81.246	39	TCP
2025-03-12T01:18:26.020882+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47620	196.251.81.246	39	TCP
2025-03-12T01:18:27.662817+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47622	196.251.81.246	39	TCP
2025-03-12T01:18:29.316483+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47624	196.251.81.246	39	TCP
2025-03-12T01:18:30.957147+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47626	196.251.81.246	39	TCP
2025-03-12T01:18:32.599130+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47628	196.251.81.246	39	TCP
2025-03-12T01:18:34.221333+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47630	196.251.81.246	39	TCP
2025-03-12T01:18:35.864185+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47632	196.251.81.246	39	TCP
2025-03-12T01:18:37.487005+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47634	196.251.81.246	39	TCP
2025-03-12T01:18:39.163987+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47636	196.251.81.246	39	TCP
2025-03-12T01:18:40.805353+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47638	196.251.81.246	39	TCP
2025-03-12T01:18:42.429309+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47640	196.251.81.246	39	TCP
2025-03-12T01:18:44.047249+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47642	196.251.81.246	39	TCP
2025-03-12T01:18:45.677539+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47644	196.251.81.246	39	TCP
2025-03-12T01:18:47.301097+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47646	196.251.81.246	39	TCP
2025-03-12T01:18:48.924378+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47648	196.251.81.246	39	TCP
2025-03-12T01:18:50.547684+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47650	196.251.81.246	39	TCP
2025-03-12T01:18:52.173120+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47652	196.251.81.246	39	TCP
2025-03-12T01:18:53.800200+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47654	196.251.81.246	39	TCP
2025-03-12T01:18:55.424489+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47656	196.251.81.246	39	TCP
2025-03-12T01:18:57.074884+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47658	196.251.81.246	39	TCP
2025-03-12T01:18:58.714025+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47660	196.251.81.246	39	TCP
2025-03-12T01:19:00.346681+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47662	196.251.81.246	39	TCP
2025-03-12T01:19:02.001013+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47664	196.251.81.246	39	TCP
2025-03-12T01:19:03.631055+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47666	196.251.81.246	39	TCP
2025-03-12T01:19:05.255351+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47668	196.251.81.246	39	TCP
2025-03-12T01:19:06.883700+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47670	196.251.81.246	39	TCP
2025-03-12T01:19:08.530170+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47672	196.251.81.246	39	TCP
2025-03-12T01:19:10.161948+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47674	196.251.81.246	39	TCP
2025-03-12T01:19:11.811241+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47676	196.251.81.246	39	TCP
2025-03-12T01:19:13.447543+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47678	196.251.81.246	39	TCP
2025-03-12T01:19:15.064942+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47680	196.251.81.246	39	TCP
2025-03-12T01:19:16.713351+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47682	196.251.81.246	39	TCP
2025-03-12T01:19:18.375418+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47684	196.251.81.246	39	TCP
2025-03-12T01:19:20.007153+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47686	196.251.81.246	39	TCP
2025-03-12T01:19:21.627651+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47688	196.251.81.246	39	TCP
2025-03-12T01:19:23.273344+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47690	196.251.81.246	39	TCP
2025-03-12T01:19:24.916346+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47692	196.251.81.246	39	TCP
2025-03-12T01:19:26.551261+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47694	196.251.81.246	39	TCP
2025-03-12T01:19:28.176368+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47696	196.251.81.246	39	TCP
2025-03-12T01:19:29.819274+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47698	196.251.81.246	39	TCP
2025-03-12T01:19:31.442181+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47700	196.251.81.246	39	TCP
2025-03-12T01:19:33.087172+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47702	196.251.81.246	39	TCP
2025-03-12T01:19:34.811203+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47704	196.251.81.246	39	TCP
2025-03-12T01:19:36.448291+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47706	196.251.81.246	39	TCP
2025-03-12T01:19:38.087318+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47708	196.251.81.246	39	TCP
2025-03-12T01:19:39.727288+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47710	196.251.81.246	39	TCP
2025-03-12T01:19:41.364356+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47712	196.251.81.246	39	TCP
2025-03-12T01:19:43.011967+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47714	196.251.81.246	39	TCP
2025-03-12T01:19:44.627101+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47716	196.251.81.246	39	TCP
2025-03-12T01:19:46.272472+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47718	196.251.81.246	39	TCP
2025-03-12T01:19:47.899963+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47720	196.251.81.246	39	TCP
2025-03-12T01:19:49.518727+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47722	196.251.81.246	39	TCP
2025-03-12T01:19:51.167425+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47724	196.251.81.246	39	TCP
2025-03-12T01:19:52.840339+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47726	196.251.81.246	39	TCP
2025-03-12T01:19:54.472815+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47728	196.251.81.246	39	TCP
2025-03-12T01:19:56.116662+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47730	196.251.81.246	39	TCP
2025-03-12T01:19:57.739378+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47732	196.251.81.246	39	TCP
2025-03-12T01:19:59.388131+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47734	196.251.81.246	39	TCP
2025-03-12T01:20:01.019245+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47736	196.251.81.246	39	TCP
2025-03-12T01:20:02.663531+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47738	196.251.81.246	39	TCP
2025-03-12T01:20:04.303373+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47740	196.251.81.246	39	TCP
2025-03-12T01:20:05.925527+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47742	196.251.81.246	39	TCP
2025-03-12T01:20:07.556938+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47744	196.251.81.246	39	TCP
2025-03-12T01:20:09.175312+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47746	196.251.81.246	39	TCP
2025-03-12T01:20:10.807617+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47748	196.251.81.246	39	TCP
2025-03-12T01:20:12.443825+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47750	196.251.81.246	39	TCP
2025-03-12T01:20:14.081636+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47752	196.251.81.246	39	TCP
2025-03-12T01:20:15.708641+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47754	196.251.81.246	39	TCP
2025-03-12T01:20:17.339313+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47756	196.251.81.246	39	TCP
2025-03-12T01:20:18.977973+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47758	196.251.81.246	39	TCP
2025-03-12T01:20:20.641256+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47760	196.251.81.246	39	TCP
2025-03-12T01:20:22.268346+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47762	196.251.81.246	39	TCP
2025-03-12T01:20:23.896169+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47764	196.251.81.246	39	TCP
2025-03-12T01:20:25.541021+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47766	196.251.81.246	39	TCP
2025-03-12T01:20:27.160766+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47768	196.251.81.246	39	TCP
2025-03-12T01:20:28.803343+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47770	196.251.81.246	39	TCP
2025-03-12T01:20:30.449111+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47772	196.251.81.246	39	TCP
2025-03-12T01:20:32.090075+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47774	196.251.81.246	39	TCP
2025-03-12T01:20:33.743088+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47776	196.251.81.246	39	TCP
2025-03-12T01:20:35.405975+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47778	196.251.81.246	39	TCP
2025-03-12T01:20:37.055021+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47780	196.251.81.246	39	TCP
2025-03-12T01:20:38.702167+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47782	196.251.81.246	39	TCP
2025-03-12T01:20:40.334422+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47784	196.251.81.246	39	TCP
2025-03-12T01:20:41.984790+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47786	196.251.81.246	39	TCP
2025-03-12T01:20:43.623180+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47788	196.251.81.246	39	TCP
2025-03-12T01:20:45.237458+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47790	196.251.81.246	39	TCP
2025-03-12T01:20:46.891976+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47792	196.251.81.246	39	TCP
2025-03-12T01:20:48.522203+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47794	196.251.81.246	39	TCP
2025-03-12T01:20:50.144851+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47796	196.251.81.246	39	TCP
2025-03-12T01:20:51.768989+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47798	196.251.81.246	39	TCP
2025-03-12T01:20:53.395208+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47800	196.251.81.246	39	TCP
2025-03-12T01:20:55.043516+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47802	196.251.81.246	39	TCP
2025-03-12T01:20:56.660858+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47804	196.251.81.246	39	TCP
2025-03-12T01:20:58.292143+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47806	196.251.81.246	39	TCP
2025-03-12T01:20:59.938525+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47808	196.251.81.246	39	TCP
2025-03-12T01:21:01.575009+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47810	196.251.81.246	39	TCP
2025-03-12T01:21:03.208607+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47812	196.251.81.246	39	TCP
2025-03-12T01:21:04.835451+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47814	196.251.81.246	39	TCP
2025-03-12T01:21:06.458997+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47816	196.251.81.246	39	TCP
2025-03-12T01:21:08.098941+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47818	196.251.81.246	39	TCP
2025-03-12T01:21:09.731093+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47820	196.251.81.246	39	TCP
2025-03-12T01:21:11.371942+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47822	196.251.81.246	39	TCP
2025-03-12T01:21:13.013608+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47824	196.251.81.246	39	TCP
2025-03-12T01:21:14.649203+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47826	196.251.81.246	39	TCP
2025-03-12T01:21:16.276857+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47828	196.251.81.246	39	TCP
2025-03-12T01:21:17.916912+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47830	196.251.81.246	39	TCP
2025-03-12T01:21:19.572348+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47832	196.251.81.246	39	TCP
2025-03-12T01:21:21.192796+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47834	196.251.81.246	39	TCP
2025-03-12T01:21:22.837335+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47836	196.251.81.246	39	TCP
2025-03-12T01:21:24.484739+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47838	196.251.81.246	39	TCP
2025-03-12T01:21:26.118866+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47840	196.251.81.246	39	TCP
2025-03-12T01:21:27.785220+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47842	196.251.81.246	39	TCP
2025-03-12T01:21:29.417562+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47844	196.251.81.246	39	TCP
2025-03-12T01:21:31.087742+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47846	196.251.81.246	39	TCP
2025-03-12T01:21:32.735318+0100	2839492	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin M3	1	192.168.2.23	47848	196.251.81.246	39	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 01:17:59.056466103 CET	443	33606	54.171.230.55	192.168.2.23
Mar 12, 2025 01:17:59.056921959 CET	33606	443	192.168.2.23	54.171.230.55
Mar 12, 2025 01:17:59.061569929 CET	443	33606	54.171.230.55	192.168.2.23
Mar 12, 2025 01:17:59.832170963 CET	47588	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:17:59.837007046 CET	39	47588	196.251.81.246	192.168.2.23
Mar 12, 2025 01:17:59.837066889 CET	47588	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:17:59.837435961 CET	47588	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:17:59.842070103 CET	39	47588	196.251.81.246	192.168.2.23
Mar 12, 2025 01:17:59.842127085 CET	47588	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:17:59.846792936 CET	39	47588	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:01.466620922 CET	39	47588	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:01.467966080 CET	47590	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:01.471333981 CET	47588	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:01.472629070 CET	39	47590	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:01.472685099 CET	47590	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:01.473433971 CET	47590	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:01.478041887 CET	39	47590	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:01.479244947 CET	47590	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:01.483386993 CET	43928	443	192.168.2.23	91.189.91.42
Mar 12, 2025 01:18:01.483860970 CET	39	47590	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:03.087857962 CET	39	47590	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:03.088490963 CET	47592	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:03.091116905 CET	47590	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:03.093133926 CET	39	47592	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:03.093215942 CET	47592	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:03.093631983 CET	47592	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:03.098249912 CET	39	47592	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:03.098315001 CET	47592	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:03.103267908 CET	39	47592	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:04.718715906 CET	39	47592	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:04.718928099 CET	47592	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:04.719517946 CET	47594	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:04.724229097 CET	39	47594	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:04.724297047 CET	47594	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:04.724749088 CET	47594	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:04.730570078 CET	39	47594	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:04.730648041 CET	47594	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:04.735348940 CET	39	47594	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:06.359184980 CET	39	47594	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:06.359808922 CET	47596	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:06.362683058 CET	47594	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:06.366033077 CET	39	47596	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:06.366089106 CET	47596	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:06.366626978 CET	47596	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:06.373605967 CET	39	47596	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:06.373647928 CET	47596	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:06.379442930 CET	39	47596	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:07.110583067 CET	42836	443	192.168.2.23	91.189.91.43
Mar 12, 2025 01:18:08.022829056 CET	39	47596	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:08.023670912 CET	47598	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:08.026432037 CET	47596	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:08.028865099 CET	39	47598	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:08.028934002 CET	47598	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:08.029592991 CET	47598	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:08.034533024 CET	39	47598	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:08.034590960 CET	47598	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:08.039534092 CET	39	47598	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:08.646384001 CET	42516	80	192.168.2.23	109.202.202.202
Mar 12, 2025 01:18:09.650320053 CET	39	47598	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:09.651058912 CET	47600	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:09.654210091 CET	47598	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:09.655746937 CET	39	47600	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:09.655805111 CET	47600	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:09.656255007 CET	47600	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:09.660911083 CET	39	47600	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:09.660949945 CET	47600	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:09.665576935 CET	39	47600	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:11.279578924 CET	39	47600	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:11.280276060 CET	47602	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:11.281984091 CET	47600	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:11.285068035 CET	39	47602	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:11.285125971 CET	47602	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:11.285557985 CET	47602	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:11.290251970 CET	39	47602	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:11.290298939 CET	47602	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:11.294914961 CET	39	47602	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:12.907628059 CET	39	47602	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:12.908431053 CET	47604	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:12.909759998 CET	47602	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:12.913093090 CET	39	47604	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:12.913141012 CET	47604	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:12.913678885 CET	47604	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:12.918358088 CET	39	47604	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:12.918400049 CET	47604	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:12.923049927 CET	39	47604	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:14.548249960 CET	39	47604	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:14.548957109 CET	47606	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:14.549527884 CET	47604	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:14.553678036 CET	39	47606	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:14.553728104 CET	47606	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:14.554466963 CET	47606	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:14.559149027 CET	39	47606	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:14.559190035 CET	47606	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:14.563862085 CET	39	47606	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:16.187086105 CET	39	47606	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:16.187989950 CET	47608	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:16.189321995 CET	47606	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:16.192672014 CET	39	47608	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:16.192723036 CET	47608	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:16.193284988 CET	47608	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:16.197927952 CET	39	47608	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:16.197973967 CET	47608	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:16.203238010 CET	39	47608	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:17.828536987 CET	39	47608	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:17.829085112 CET	47608	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:17.829293966 CET	47610	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:17.833939075 CET	39	47610	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:17.833995104 CET	47610	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:17.834696054 CET	47610	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:17.839353085 CET	39	47610	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:17.839412928 CET	47610	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:17.844058037 CET	39	47610	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:19.449107885 CET	39	47610	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:19.449863911 CET	47612	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:19.452857971 CET	47610	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:19.455033064 CET	39	47612	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:19.455087900 CET	47612	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:19.455549955 CET	47612	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:19.460705042 CET	39	47612	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:19.460746050 CET	47612	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:19.465645075 CET	39	47612	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:21.091185093 CET	39	47612	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:21.091833115 CET	47614	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:21.092636108 CET	47612	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:21.096558094 CET	39	47614	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:21.096645117 CET	47614	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:21.097274065 CET	47614	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:21.102004051 CET	39	47614	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:21.102055073 CET	47614	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:21.106731892 CET	39	47614	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:21.444814920 CET	43928	443	192.168.2.23	91.189.91.42
Mar 12, 2025 01:18:22.741962910 CET	39	47614	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:22.742728949 CET	47616	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:22.744406939 CET	47614	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:22.747464895 CET	39	47616	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:22.747523069 CET	47616	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:22.748023987 CET	47616	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:22.752643108 CET	39	47616	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:22.752684116 CET	47616	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:22.757550955 CET	39	47616	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:24.373639107 CET	39	47616	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:24.374560118 CET	47618	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:24.376189947 CET	47616	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:24.380779028 CET	39	47618	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:24.380873919 CET	47618	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:24.381364107 CET	47618	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:24.387932062 CET	39	47618	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:24.388000011 CET	47618	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:24.394486904 CET	39	47618	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:26.013962984 CET	39	47618	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:26.014906883 CET	47620	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:26.015970945 CET	47618	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:26.020329952 CET	39	47620	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:26.020380974 CET	47620	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:26.020881891 CET	47620	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:26.027787924 CET	39	47620	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:26.027827978 CET	47620	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:26.034580946 CET	39	47620	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:27.656498909 CET	39	47620	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:27.657491922 CET	47622	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:27.659734011 CET	47620	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:27.662199974 CET	39	47622	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:27.662261963 CET	47622	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:27.662817001 CET	47622	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:27.667498112 CET	39	47622	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:27.667537928 CET	47622	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:27.672188044 CET	39	47622	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:29.309935093 CET	39	47622	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:29.310717106 CET	47624	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:29.311512947 CET	47622	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:29.315840960 CET	39	47624	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:29.315913916 CET	47624	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:29.316483021 CET	47624	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:29.321475029 CET	39	47624	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:29.321513891 CET	47624	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:29.326255083 CET	39	47624	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:30.951086998 CET	39	47624	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:30.951286077 CET	47624	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:30.951684952 CET	47626	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:30.956481934 CET	39	47626	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:30.956634998 CET	47626	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:30.957146883 CET	47626	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:30.962198019 CET	39	47626	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:30.962239027 CET	47626	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:30.967395067 CET	39	47626	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:32.591979027 CET	39	47626	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:32.592684031 CET	47628	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:32.595056057 CET	47626	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:32.598387003 CET	39	47628	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:32.598536968 CET	47628	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:32.599129915 CET	47628	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:32.603821993 CET	39	47628	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:32.603863001 CET	47628	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:32.608489037 CET	39	47628	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:33.730927944 CET	42836	443	192.168.2.23	91.189.91.43
Mar 12, 2025 01:18:34.214603901 CET	39	47628	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:34.214838982 CET	47628	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:34.215130091 CET	47630	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:34.220590115 CET	39	47630	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:34.220643997 CET	47630	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:34.221333027 CET	47630	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:34.226140022 CET	39	47630	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:34.226182938 CET	47630	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:34.231313944 CET	39	47630	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:35.858175039 CET	39	47630	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:35.858607054 CET	47630	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:35.858740091 CET	47632	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:35.863521099 CET	39	47632	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:35.863615036 CET	47632	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:35.864185095 CET	47632	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:35.868853092 CET	39	47632	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:35.868906975 CET	47632	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:35.873590946 CET	39	47632	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:37.480966091 CET	39	47632	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:37.481703997 CET	47634	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:37.482386112 CET	47632	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:37.486356020 CET	39	47634	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:37.486417055 CET	47634	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:37.487004995 CET	47634	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:37.491647959 CET	39	47634	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:37.491698027 CET	47634	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:37.496346951 CET	39	47634	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:39.158158064 CET	39	47634	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:39.158755064 CET	47636	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:39.162154913 CET	47634	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:39.163431883 CET	39	47636	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:39.163496971 CET	47636	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:39.163986921 CET	47636	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:39.168589115 CET	39	47636	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:39.168724060 CET	47636	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:39.173383951 CET	39	47636	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:39.874088049 CET	42516	80	192.168.2.23	109.202.202.202
Mar 12, 2025 01:18:40.798861980 CET	39	47636	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:40.799465895 CET	47638	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:40.801928043 CET	47636	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:40.804758072 CET	39	47638	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:40.804852009 CET	47638	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:40.805352926 CET	47638	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:40.811043024 CET	39	47638	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:40.811108112 CET	47638	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:40.816756010 CET	39	47638	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:42.420874119 CET	39	47638	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:42.421560049 CET	47640	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:42.421746016 CET	47638	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:42.428728104 CET	39	47640	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:42.428860903 CET	47640	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:42.429308891 CET	47640	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:42.436480999 CET	39	47640	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:42.436547041 CET	47640	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:42.443938971 CET	39	47640	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:44.041554928 CET	39	47640	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:44.042007923 CET	47642	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:44.045505047 CET	47640	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:44.046780109 CET	39	47642	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:44.046883106 CET	47642	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:44.047249079 CET	47642	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:44.051970959 CET	39	47642	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:44.052058935 CET	47642	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:44.056778908 CET	39	47642	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:45.671705008 CET	39	47642	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:45.672235966 CET	47644	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:45.673264027 CET	47642	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:45.676983118 CET	39	47644	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:45.677079916 CET	47644	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:45.677539110 CET	47644	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:45.682180882 CET	39	47644	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:45.682240009 CET	47644	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:45.686942101 CET	39	47644	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:47.292964935 CET	39	47644	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:47.293474913 CET	47646	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:47.297044992 CET	47644	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:47.300534964 CET	39	47646	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:47.300621033 CET	47646	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:47.301096916 CET	47646	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:47.306432009 CET	39	47646	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:47.306502104 CET	47646	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:47.311809063 CET	39	47646	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:48.918476105 CET	39	47646	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:48.919112921 CET	47648	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:48.920819044 CET	47646	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:48.923806906 CET	39	47648	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:48.923861980 CET	47648	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:48.924377918 CET	47648	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:48.929078102 CET	39	47648	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:48.929136992 CET	47648	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:48.933856964 CET	39	47648	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:50.542006016 CET	39	47648	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:50.542428017 CET	47650	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:50.544589996 CET	47648	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:50.547158003 CET	39	47650	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:50.547303915 CET	47650	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:50.547683954 CET	47650	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:50.552752018 CET	39	47650	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:50.552794933 CET	47650	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:50.558010101 CET	39	47650	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:52.167280912 CET	39	47650	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:52.167927027 CET	47652	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:52.168365002 CET	47650	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:52.172564983 CET	39	47652	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:52.172622919 CET	47652	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:52.173120022 CET	47652	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:52.177735090 CET	39	47652	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:52.177782059 CET	47652	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:52.182390928 CET	39	47652	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:53.794370890 CET	39	47652	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:53.794967890 CET	47654	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:53.796148062 CET	47652	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:53.799654007 CET	39	47654	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:53.799707890 CET	47654	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:53.800199986 CET	47654	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:53.804841042 CET	39	47654	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:53.804886103 CET	47654	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:53.809494972 CET	39	47654	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:55.418416977 CET	39	47654	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:55.419203043 CET	47656	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:55.419919968 CET	47654	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:55.423928976 CET	39	47656	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:55.423990965 CET	47656	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:55.424489021 CET	47656	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:55.429104090 CET	39	47656	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:55.429157019 CET	47656	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:55.433823109 CET	39	47656	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:57.068835020 CET	39	47656	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:57.069360971 CET	47658	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:57.071702957 CET	47656	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:57.074331999 CET	39	47658	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:57.074487925 CET	47658	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:57.074883938 CET	47658	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:57.079693079 CET	39	47658	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:57.079751968 CET	47658	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:57.084433079 CET	39	47658	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:58.708323002 CET	39	47658	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:58.708770990 CET	47660	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:58.711467028 CET	47658	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:58.713454008 CET	39	47660	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:58.713639975 CET	47660	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:58.714025021 CET	47660	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:58.718647003 CET	39	47660	196.251.81.246	192.168.2.23
Mar 12, 2025 01:18:58.718693972 CET	47660	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:18:58.723303080 CET	39	47660	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:00.340872049 CET	39	47660	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:00.341444016 CET	47662	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:00.343250990 CET	47660	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:00.346131086 CET	39	47662	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:00.346283913 CET	47662	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:00.346681118 CET	47662	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:00.351288080 CET	39	47662	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:00.351340055 CET	47662	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:00.356005907 CET	39	47662	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:01.995208979 CET	39	47662	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:01.995667934 CET	47664	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:01.999018908 CET	47662	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:02.000437021 CET	39	47664	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:02.000520945 CET	47664	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:02.001013041 CET	47664	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:02.005733967 CET	39	47664	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:02.005808115 CET	47664	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:02.010564089 CET	39	47664	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:02.398983002 CET	43928	443	192.168.2.23	91.189.91.42
Mar 12, 2025 01:19:03.625067949 CET	39	47664	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:03.625940084 CET	47666	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:03.626795053 CET	47664	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:03.630650997 CET	39	47666	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:03.630726099 CET	47666	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:03.631055117 CET	47666	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:03.635710001 CET	39	47666	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:03.635777950 CET	47666	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:03.640451908 CET	39	47666	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:05.249300003 CET	39	47666	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:05.250021935 CET	47668	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:05.250566959 CET	47666	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:05.254734993 CET	39	47668	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:05.254844904 CET	47668	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:05.255351067 CET	47668	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:05.259990931 CET	39	47668	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:05.260091066 CET	47668	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:05.264729977 CET	39	47668	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:06.877630949 CET	39	47668	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:06.878303051 CET	47670	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:06.878365993 CET	47668	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:06.883089066 CET	39	47670	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:06.883194923 CET	47670	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:06.883699894 CET	47670	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:06.888385057 CET	39	47670	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:06.888454914 CET	47670	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:06.893064022 CET	39	47670	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:08.524154902 CET	39	47670	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:08.524840117 CET	47672	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:08.526120901 CET	47670	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:08.529536963 CET	39	47672	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:08.529668093 CET	47672	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:08.530169964 CET	47672	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:08.534789085 CET	39	47672	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:08.534857988 CET	47672	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:08.539522886 CET	39	47672	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:10.155340910 CET	39	47672	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:10.155881882 CET	47674	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:10.161346912 CET	39	47674	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:10.161617041 CET	47674	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:10.161907911 CET	47672	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:10.161947966 CET	47674	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:10.166614056 CET	39	47674	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:10.166690111 CET	47674	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:10.171304941 CET	39	47674	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:11.805135965 CET	39	47674	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:11.805728912 CET	47674	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:11.806018114 CET	47676	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:11.810642958 CET	39	47676	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:11.810734034 CET	47676	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:11.811240911 CET	47676	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:11.815845013 CET	39	47676	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:11.815897942 CET	47676	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:11.820544004 CET	39	47676	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:13.441818953 CET	39	47676	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:13.442333937 CET	47678	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:13.445472002 CET	47676	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:13.447063923 CET	39	47678	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:13.447129965 CET	47678	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:13.447542906 CET	47678	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:13.452150106 CET	39	47678	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:13.452229977 CET	47678	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:13.456866026 CET	39	47678	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:15.059118032 CET	39	47678	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:15.059619904 CET	47680	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:15.061223030 CET	47678	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:15.064336061 CET	39	47680	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:15.064412117 CET	47680	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:15.064941883 CET	47680	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:15.069592953 CET	39	47680	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:15.069648027 CET	47680	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:15.074333906 CET	39	47680	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:16.707585096 CET	39	47680	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:16.708113909 CET	47682	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:16.709000111 CET	47680	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:16.712807894 CET	39	47682	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:16.712862015 CET	47682	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:16.713351011 CET	47682	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:16.718002081 CET	39	47682	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:16.718050957 CET	47682	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:16.722718954 CET	39	47682	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:18.369581938 CET	39	47682	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:18.370096922 CET	47684	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:18.372773886 CET	47682	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:18.374867916 CET	39	47684	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:18.375025988 CET	47684	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:18.375417948 CET	47684	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:18.380031109 CET	39	47684	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:18.380095959 CET	47684	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:18.384767056 CET	39	47684	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:20.000864029 CET	39	47684	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:20.001457930 CET	47686	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:20.004548073 CET	47684	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:20.006707907 CET	39	47686	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:20.006782055 CET	47686	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:20.007153034 CET	47686	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:20.011785030 CET	39	47686	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:20.011848927 CET	47686	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:20.016536951 CET	39	47686	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:21.621874094 CET	39	47686	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:21.622370958 CET	47688	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:21.624322891 CET	47686	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:21.627063990 CET	39	47688	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:21.627114058 CET	47688	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:21.627650976 CET	47688	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:21.632328033 CET	39	47688	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:21.632405043 CET	47688	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:21.637104034 CET	39	47688	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:23.267318964 CET	39	47688	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:23.267968893 CET	47690	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:23.268098116 CET	47688	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:23.272758961 CET	39	47690	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:23.272815943 CET	47690	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:23.273344040 CET	47690	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:23.278021097 CET	39	47690	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:23.278074980 CET	47690	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:23.282771111 CET	39	47690	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:24.910378933 CET	39	47690	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:24.911007881 CET	47692	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:24.911885023 CET	47690	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:24.915812969 CET	39	47692	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:24.915971994 CET	47692	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:24.916346073 CET	47692	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:24.921015978 CET	39	47692	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:24.921056986 CET	47692	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:24.926726103 CET	39	47692	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:26.545319080 CET	39	47692	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:26.545958996 CET	47694	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:26.547646046 CET	47692	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:26.550687075 CET	39	47694	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:26.550766945 CET	47694	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:26.551260948 CET	47694	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:26.555972099 CET	39	47694	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:26.556032896 CET	47694	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:26.560795069 CET	39	47694	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:28.170546055 CET	39	47694	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:28.171139956 CET	47696	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:28.171432972 CET	47694	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:28.175820112 CET	39	47696	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:28.175894022 CET	47696	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:28.176367998 CET	47696	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:28.181068897 CET	39	47696	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:28.181143999 CET	47696	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:28.185861111 CET	39	47696	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:29.813637972 CET	39	47696	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:29.814186096 CET	47698	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:29.815190077 CET	47696	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:29.818861008 CET	39	47698	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:29.818960905 CET	47698	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:29.819273949 CET	47698	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:29.823879004 CET	39	47698	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:29.823921919 CET	47698	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:29.828587055 CET	39	47698	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:31.436156988 CET	39	47698	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:31.436800957 CET	47700	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:31.438977957 CET	47698	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:31.441484928 CET	39	47700	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:31.441586971 CET	47700	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:31.442181110 CET	47700	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:31.446774960 CET	39	47700	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:31.446861029 CET	47700	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:31.451471090 CET	39	47700	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:33.080475092 CET	39	47700	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:33.081012964 CET	47702	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:33.082778931 CET	47700	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:33.086622953 CET	39	47702	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:33.086688042 CET	47702	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:33.087172031 CET	47702	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:33.092828035 CET	39	47702	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:33.092886925 CET	47702	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:33.098577023 CET	39	47702	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:34.804249048 CET	39	47702	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:34.804840088 CET	47704	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:34.806514978 CET	47702	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:34.810643911 CET	39	47704	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:34.810755014 CET	47704	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:34.811203003 CET	47704	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:34.816844940 CET	39	47704	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:34.816910028 CET	47704	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:34.822112083 CET	39	47704	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:36.442425966 CET	39	47704	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:36.443044901 CET	47706	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:36.446293116 CET	47704	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:36.447758913 CET	39	47706	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:36.447824955 CET	47706	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:36.448291063 CET	47706	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:36.452956915 CET	39	47706	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:36.453018904 CET	47706	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:36.457664967 CET	39	47706	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:38.080229998 CET	39	47706	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:38.080892086 CET	47708	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:38.082061052 CET	47706	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:38.086735010 CET	39	47708	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:38.086807013 CET	47708	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:38.087317944 CET	47708	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:38.092822075 CET	39	47708	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:38.092880011 CET	47708	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:38.097654104 CET	39	47708	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:39.721458912 CET	39	47708	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:39.721837997 CET	47708	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:39.722004890 CET	47710	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:39.726720095 CET	39	47710	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:39.726785898 CET	47710	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:39.727288008 CET	47710	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:39.731954098 CET	39	47710	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:39.732022047 CET	47710	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:39.736711025 CET	39	47710	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:41.358320951 CET	39	47710	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:41.358968973 CET	47712	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:41.361615896 CET	47710	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:41.363780022 CET	39	47712	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:41.363970995 CET	47712	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:41.364356041 CET	47712	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:41.368978024 CET	39	47712	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:41.369030952 CET	47712	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:41.373663902 CET	39	47712	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:43.006182909 CET	39	47712	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:43.006644011 CET	47714	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:43.009397984 CET	47712	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:43.011378050 CET	39	47714	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:43.011538982 CET	47714	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:43.011966944 CET	47714	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:43.016633987 CET	39	47714	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:43.016680956 CET	47714	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:43.021338940 CET	39	47714	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:44.621181011 CET	39	47714	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:44.621809006 CET	47716	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:44.625160933 CET	47714	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:44.626559973 CET	39	47716	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:44.626724005 CET	47716	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:44.627100945 CET	47716	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:44.631740093 CET	39	47716	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:44.631793022 CET	47716	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:44.636457920 CET	39	47716	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:46.266666889 CET	39	47716	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:46.267268896 CET	47718	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:46.268949032 CET	47716	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:46.271905899 CET	39	47718	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:46.271967888 CET	47718	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:46.272471905 CET	47718	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:46.277123928 CET	39	47718	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:46.277175903 CET	47718	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:46.281802893 CET	39	47718	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:47.894043922 CET	39	47718	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:47.894556046 CET	47720	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:47.896712065 CET	47718	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:47.899384022 CET	39	47720	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:47.899439096 CET	47720	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:47.899962902 CET	47720	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:47.904663086 CET	39	47720	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:47.904707909 CET	47720	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:47.909427881 CET	39	47720	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:49.512834072 CET	39	47720	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:49.513438940 CET	47722	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:49.516494989 CET	47720	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:49.518194914 CET	39	47722	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:49.518348932 CET	47722	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:49.518727064 CET	47722	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:49.523444891 CET	39	47722	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:49.523493052 CET	47722	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:49.528146982 CET	39	47722	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:51.161765099 CET	39	47722	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:51.162184954 CET	47724	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:51.164267063 CET	47722	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:51.166898966 CET	39	47724	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:51.167057037 CET	47724	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:51.167424917 CET	47724	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:51.172199011 CET	39	47724	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:51.172256947 CET	47724	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:51.176939011 CET	39	47724	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:52.834496021 CET	39	47724	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:52.835033894 CET	47726	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:52.836034060 CET	47724	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:52.839756966 CET	39	47726	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:52.839816093 CET	47726	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:52.840338945 CET	47726	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:52.845035076 CET	39	47726	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:52.845086098 CET	47726	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:52.849766016 CET	39	47726	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:54.466747046 CET	39	47726	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:54.467320919 CET	47728	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:54.467818022 CET	47726	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:54.472203016 CET	39	47728	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:54.472292900 CET	47728	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:54.472815037 CET	47728	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:54.477813959 CET	39	47728	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:54.477864027 CET	47728	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:54.483196974 CET	39	47728	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:56.110542059 CET	39	47728	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:56.111201048 CET	47730	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:56.111588955 CET	47728	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:56.116061926 CET	39	47730	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:56.116195917 CET	47730	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:56.116662025 CET	47730	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:56.121321917 CET	39	47730	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:56.121414900 CET	47730	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:56.126164913 CET	39	47730	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:57.732342958 CET	39	47730	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:57.732959032 CET	47732	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:57.735375881 CET	47730	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:57.738945007 CET	39	47732	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:57.739002943 CET	47732	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:57.739377975 CET	47732	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:57.745848894 CET	39	47732	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:57.746129036 CET	47732	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:57.752207041 CET	39	47732	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:59.382281065 CET	39	47732	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:59.382869005 CET	47734	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:59.383137941 CET	47732	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:59.387655973 CET	39	47734	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:59.387737989 CET	47734	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:59.388130903 CET	47734	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:59.393697977 CET	39	47734	196.251.81.246	192.168.2.23
Mar 12, 2025 01:19:59.393765926 CET	47734	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:19:59.398721933 CET	39	47734	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:01.013392925 CET	39	47734	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:01.013952971 CET	47736	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:01.014918089 CET	47734	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:01.018654108 CET	39	47736	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:01.018752098 CET	47736	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:01.019244909 CET	47736	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:01.023839951 CET	39	47736	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:01.023905993 CET	47736	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:01.028574944 CET	39	47736	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:02.657530069 CET	39	47736	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:02.658237934 CET	47738	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:02.658705950 CET	47736	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:02.662925005 CET	39	47738	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:02.663038969 CET	47738	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:02.663531065 CET	47738	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:02.668133020 CET	39	47738	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:02.668203115 CET	47738	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:02.672810078 CET	39	47738	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:04.296525002 CET	39	47738	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:04.297153950 CET	47740	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:04.298458099 CET	47738	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:04.302736998 CET	39	47740	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:04.302848101 CET	47740	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:04.303373098 CET	47740	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:04.308327913 CET	39	47740	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:04.308398008 CET	47740	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:04.313436985 CET	39	47740	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:05.919703007 CET	39	47740	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:05.920236111 CET	47742	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:05.922240973 CET	47740	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:05.924873114 CET	39	47742	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:05.925005913 CET	47742	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:05.925527096 CET	47742	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:05.930232048 CET	39	47742	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:05.930298090 CET	47742	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:05.934910059 CET	39	47742	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:07.551071882 CET	39	47742	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:07.551671982 CET	47744	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:07.554008961 CET	47742	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:07.556454897 CET	39	47744	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:07.556524038 CET	47744	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:07.556937933 CET	47744	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:07.561558962 CET	39	47744	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:07.561619043 CET	47744	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:07.566324949 CET	39	47744	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:09.169548035 CET	39	47744	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:09.169802904 CET	47744	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:09.170078993 CET	47746	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:09.174760103 CET	39	47746	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:09.174828053 CET	47746	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:09.175312042 CET	47746	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:09.179956913 CET	39	47746	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:09.180007935 CET	47746	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:09.184719086 CET	39	47746	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:10.801784039 CET	39	47746	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:10.802345037 CET	47748	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:10.805581093 CET	47746	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:10.807110071 CET	39	47748	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:10.807216883 CET	47748	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:10.807616949 CET	47748	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:10.812268972 CET	39	47748	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:10.812377930 CET	47748	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:10.817059040 CET	39	47748	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:12.437290907 CET	39	47748	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:12.437885046 CET	47750	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:12.441368103 CET	47748	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:12.443342924 CET	39	47750	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:12.443440914 CET	47750	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:12.443825006 CET	47750	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:12.448659897 CET	39	47750	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:12.448725939 CET	47750	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:12.453346968 CET	39	47750	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:14.075813055 CET	39	47750	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:14.076334953 CET	47752	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:14.077111959 CET	47750	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:14.081023932 CET	39	47752	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:14.081125021 CET	47752	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:14.081635952 CET	47752	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:14.086292982 CET	39	47752	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:14.086359024 CET	47752	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:14.091006041 CET	39	47752	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:15.702676058 CET	39	47752	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:15.703285933 CET	47754	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:15.704893112 CET	47752	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:15.708055973 CET	39	47754	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:15.708159924 CET	47754	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:15.708641052 CET	47754	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:15.713262081 CET	39	47754	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:15.713361979 CET	47754	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:15.717982054 CET	39	47754	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:17.332134008 CET	39	47754	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:17.332693100 CET	47754	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:17.332710981 CET	47756	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:17.338731050 CET	39	47756	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:17.338824034 CET	47756	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:17.339313030 CET	47756	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:17.344250917 CET	39	47756	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:17.344315052 CET	47756	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:17.349689007 CET	39	47756	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:18.972203016 CET	39	47756	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:18.972444057 CET	47756	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:18.972737074 CET	47758	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:18.977410078 CET	39	47758	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:18.977509022 CET	47758	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:18.977972984 CET	47758	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:18.982671976 CET	39	47758	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:18.982739925 CET	47758	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:18.987395048 CET	39	47758	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:20.634639025 CET	39	47758	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:20.635289907 CET	47760	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:20.636209011 CET	47758	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:20.640644073 CET	39	47760	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:20.640698910 CET	47760	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:20.641256094 CET	47760	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:20.646625996 CET	39	47760	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:20.646671057 CET	47760	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:20.651344061 CET	39	47760	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:22.262348890 CET	39	47760	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:22.262968063 CET	47762	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:22.263989925 CET	47760	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:22.267784119 CET	39	47762	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:22.267940044 CET	47762	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:22.268346071 CET	47762	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:22.273025036 CET	39	47762	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:22.273078918 CET	47762	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:22.277831078 CET	39	47762	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:23.890379906 CET	39	47762	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:23.890913963 CET	47764	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:23.891773939 CET	47762	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:23.895627022 CET	39	47764	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:23.895776033 CET	47764	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:23.896168947 CET	47764	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:23.900851011 CET	39	47764	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:23.900897026 CET	47764	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:23.905565023 CET	39	47764	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:25.535136938 CET	39	47764	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:25.535542965 CET	47764	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:25.535700083 CET	47766	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:25.540469885 CET	39	47766	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:25.540633917 CET	47766	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:25.541021109 CET	47766	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:25.545675039 CET	39	47766	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:25.545722008 CET	47766	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:25.550425053 CET	39	47766	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:27.154705048 CET	39	47766	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:27.155343056 CET	47766	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:27.155472040 CET	47768	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:27.160170078 CET	39	47768	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:27.160233021 CET	47768	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:27.160765886 CET	47768	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:27.165388107 CET	39	47768	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:27.165436029 CET	47768	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:27.170061111 CET	39	47768	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:28.797508955 CET	39	47768	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:28.798028946 CET	47770	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:28.799104929 CET	47768	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:28.802762985 CET	39	47770	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:28.802819967 CET	47770	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:28.803343058 CET	47770	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:28.808013916 CET	39	47770	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:28.808068991 CET	47770	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:28.812679052 CET	39	47770	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:30.443342924 CET	39	47770	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:30.443857908 CET	47772	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:30.446868896 CET	47770	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:30.448575974 CET	39	47772	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:30.448731899 CET	47772	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:30.449110985 CET	47772	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:30.453810930 CET	39	47772	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:30.453872919 CET	47772	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:30.458498001 CET	39	47772	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:32.084172964 CET	39	47772	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:32.084845066 CET	47774	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:32.086651087 CET	47772	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:32.089539051 CET	39	47774	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:32.089586973 CET	47774	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:32.090075016 CET	47774	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:32.094675064 CET	39	47774	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:32.094713926 CET	47774	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:32.099334955 CET	39	47774	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:33.737216949 CET	39	47774	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:33.737730980 CET	47776	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:33.738415956 CET	47774	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:33.742456913 CET	39	47776	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:33.742589951 CET	47776	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:33.743088007 CET	47776	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:33.747726917 CET	39	47776	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:33.747802019 CET	47776	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:33.752490997 CET	39	47776	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:35.399951935 CET	39	47776	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:35.400583982 CET	47778	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:35.402192116 CET	47776	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:35.405404091 CET	39	47778	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:35.405494928 CET	47778	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:35.405975103 CET	47778	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:35.412707090 CET	39	47778	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:35.412776947 CET	47778	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:35.418839931 CET	39	47778	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:37.049102068 CET	39	47778	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:37.049671888 CET	47780	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:37.049957991 CET	47778	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:37.054409981 CET	39	47780	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:37.054527998 CET	47780	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:37.055021048 CET	47780	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:37.059696913 CET	39	47780	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:37.059792042 CET	47780	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:37.064435959 CET	39	47780	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:38.696228981 CET	39	47780	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:38.696849108 CET	47782	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:38.697742939 CET	47780	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:38.701584101 CET	39	47782	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:38.701657057 CET	47782	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:38.702167034 CET	47782	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:38.706871033 CET	39	47782	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:38.706923962 CET	47782	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:38.711622000 CET	39	47782	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:40.328577042 CET	39	47782	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:40.329099894 CET	47784	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:40.329505920 CET	47782	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:40.333837032 CET	39	47784	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:40.333925962 CET	47784	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:40.334422112 CET	47784	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:40.339082003 CET	39	47784	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:40.339153051 CET	47784	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:40.343828917 CET	39	47784	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:41.978796005 CET	39	47784	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:41.979432106 CET	47786	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:41.981277943 CET	47784	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:41.984189987 CET	39	47786	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:41.984303951 CET	47786	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:41.984790087 CET	47786	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:41.989500999 CET	39	47786	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:41.989571095 CET	47786	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:41.994309902 CET	39	47786	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:43.617532969 CET	39	47786	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:43.617968082 CET	47788	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:43.621057034 CET	47786	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:43.622648954 CET	39	47788	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:43.622704983 CET	47788	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:43.623179913 CET	47788	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:43.627767086 CET	39	47788	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:43.627815962 CET	47788	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:43.632471085 CET	39	47788	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:45.231637955 CET	39	47788	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:45.232197046 CET	47790	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:45.232829094 CET	47788	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:45.236924887 CET	39	47790	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:45.236983061 CET	47790	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:45.237457991 CET	47790	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:45.242091894 CET	39	47790	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:45.242137909 CET	47790	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:45.246876955 CET	39	47790	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:46.882900000 CET	39	47790	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:46.884406090 CET	47792	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:46.884623051 CET	47790	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:46.889122009 CET	39	47792	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:46.889188051 CET	47792	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:46.891976118 CET	47792	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:46.896646976 CET	39	47792	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:46.903693914 CET	47792	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:46.908294916 CET	39	47792	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:48.515922070 CET	39	47792	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:48.516582012 CET	47792	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:48.517013073 CET	47794	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:48.521742105 CET	39	47794	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:48.521807909 CET	47794	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:48.522202969 CET	47794	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:48.526874065 CET	39	47794	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:48.526930094 CET	47794	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:48.531543016 CET	39	47794	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:50.138900995 CET	39	47794	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:50.139476061 CET	47796	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:50.140322924 CET	47794	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:50.144134045 CET	39	47796	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:50.144201994 CET	47796	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:50.144850969 CET	47796	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:50.149528027 CET	39	47796	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:50.149570942 CET	47796	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:50.154313087 CET	39	47796	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:51.762794018 CET	39	47796	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:51.763329029 CET	47798	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:51.763936996 CET	47796	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:51.768425941 CET	39	47798	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:51.768486023 CET	47798	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:51.768989086 CET	47798	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:51.774203062 CET	39	47798	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:51.774260998 CET	47798	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:51.779273987 CET	39	47798	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:53.389264107 CET	39	47798	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:53.389811993 CET	47800	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:53.391716003 CET	47798	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:53.394644022 CET	39	47800	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:53.394695997 CET	47800	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:53.395207882 CET	47800	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:53.399840117 CET	39	47800	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:53.399880886 CET	47800	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:53.404534101 CET	39	47800	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:55.037163019 CET	39	47800	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:55.037969112 CET	47802	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:55.039504051 CET	47800	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:55.043035030 CET	39	47802	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:55.043087959 CET	47802	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:55.043515921 CET	47802	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:55.048662901 CET	39	47802	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:55.048703909 CET	47802	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:55.053332090 CET	39	47802	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:56.654961109 CET	39	47802	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:56.655270100 CET	47802	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:56.655589104 CET	47804	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:56.660290956 CET	39	47804	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:56.660341978 CET	47804	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:56.660857916 CET	47804	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:56.665524006 CET	39	47804	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:56.665590048 CET	47804	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:56.670296907 CET	39	47804	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:58.286258936 CET	39	47804	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:58.286845922 CET	47806	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:58.287050009 CET	47804	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:58.291608095 CET	39	47806	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:58.291659117 CET	47806	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:58.292143106 CET	47806	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:58.296756983 CET	39	47806	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:58.296818972 CET	47806	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:58.301433086 CET	39	47806	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:59.931883097 CET	39	47806	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:59.932413101 CET	47808	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:59.934813023 CET	47806	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:59.937952042 CET	39	47808	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:59.938060999 CET	47808	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:59.938524961 CET	47808	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:59.943500042 CET	39	47808	196.251.81.246	192.168.2.23
Mar 12, 2025 01:20:59.943550110 CET	47808	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:20:59.948292017 CET	39	47808	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:01.569041967 CET	39	47808	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:01.569690943 CET	47810	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:01.570589066 CET	47808	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:01.574461937 CET	39	47810	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:01.574538946 CET	47810	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:01.575009108 CET	47810	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:01.579662085 CET	39	47810	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:01.579715014 CET	47810	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:01.584372044 CET	39	47810	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:03.202322006 CET	39	47810	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:03.203368902 CET	47812	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:03.206373930 CET	47810	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:03.208060980 CET	39	47812	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:03.208158970 CET	47812	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:03.208606958 CET	47812	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:03.213304996 CET	39	47812	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:03.213382006 CET	47812	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:03.217978001 CET	39	47812	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:04.828574896 CET	39	47812	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:04.829602003 CET	47814	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:04.830162048 CET	47812	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:04.834892988 CET	39	47814	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:04.835005045 CET	47814	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:04.835450888 CET	47814	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:04.840780020 CET	39	47814	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:04.840852022 CET	47814	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:04.845859051 CET	39	47814	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:06.452982903 CET	39	47814	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:06.453824997 CET	47816	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:06.453928947 CET	47814	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:06.458529949 CET	39	47816	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:06.458601952 CET	47816	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:06.458997011 CET	47816	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:06.463632107 CET	39	47816	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:06.463685989 CET	47816	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:06.468321085 CET	39	47816	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:08.092921019 CET	39	47816	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:08.093580008 CET	47818	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:08.093709946 CET	47816	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:08.098419905 CET	39	47818	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:08.098542929 CET	47818	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:08.098941088 CET	47818	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:08.103616953 CET	39	47818	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:08.103682995 CET	47818	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:08.108442068 CET	39	47818	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:09.725106955 CET	39	47818	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:09.725469112 CET	47818	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:09.725743055 CET	47820	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:09.730480909 CET	39	47820	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:09.730556965 CET	47820	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:09.731092930 CET	47820	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:09.735815048 CET	39	47820	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:09.735867023 CET	47820	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:09.740537882 CET	39	47820	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:11.366004944 CET	39	47820	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:11.366822958 CET	47822	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:11.369276047 CET	47820	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:11.371494055 CET	39	47822	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:11.371596098 CET	47822	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:11.371942043 CET	47822	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:11.376547098 CET	39	47822	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:11.376629114 CET	47822	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:11.381247997 CET	39	47822	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:13.007359982 CET	39	47822	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:13.008158922 CET	47824	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:13.009016991 CET	47822	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:13.013076067 CET	39	47824	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:13.013128996 CET	47824	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:13.013607979 CET	47824	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:13.018281937 CET	39	47824	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:13.018352985 CET	47824	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:13.023006916 CET	39	47824	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:14.643313885 CET	39	47824	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:14.643898010 CET	47826	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:14.644792080 CET	47824	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:14.648639917 CET	39	47826	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:14.648696899 CET	47826	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:14.649203062 CET	47826	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:14.653882027 CET	39	47826	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:14.653937101 CET	47826	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:14.658551931 CET	39	47826	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:16.270821095 CET	39	47826	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:16.271594048 CET	47828	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:16.272587061 CET	47826	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:16.276396990 CET	39	47828	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:16.276465893 CET	47828	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:16.276856899 CET	47828	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:16.281507015 CET	39	47828	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:16.281575918 CET	47828	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:16.286314011 CET	39	47828	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:17.910960913 CET	39	47828	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:17.911683083 CET	47830	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:17.912339926 CET	47828	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:17.916340113 CET	39	47830	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:17.916497946 CET	47830	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:17.916912079 CET	47830	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:17.921546936 CET	39	47830	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:17.921616077 CET	47830	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:17.926237106 CET	39	47830	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:19.565963984 CET	39	47830	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:19.566941977 CET	47832	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:19.568111897 CET	47830	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:19.571650028 CET	39	47832	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:19.571706057 CET	47832	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:19.572348118 CET	47832	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:19.577022076 CET	39	47832	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:19.577075005 CET	47832	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:19.581727028 CET	39	47832	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:21.186976910 CET	39	47832	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:21.187542915 CET	47834	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:21.187906981 CET	47832	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:21.192256927 CET	39	47834	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:21.192424059 CET	47834	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:21.192795992 CET	47834	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:21.197438955 CET	39	47834	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:21.197489023 CET	47834	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:21.202178001 CET	39	47834	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:22.830631018 CET	39	47834	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:22.831279039 CET	47836	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:22.831676960 CET	47834	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:22.836771011 CET	39	47836	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:22.836932898 CET	47836	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:22.837335110 CET	47836	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:22.842344046 CET	39	47836	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:22.842407942 CET	47836	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:22.847100973 CET	39	47836	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:24.478008032 CET	39	47836	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:24.478568077 CET	47838	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:24.479439974 CET	47836	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:24.484209061 CET	39	47838	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:24.484383106 CET	47838	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:24.484739065 CET	47838	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:24.490747929 CET	39	47838	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:24.490808010 CET	47838	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:24.495491028 CET	39	47838	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:26.112529993 CET	39	47838	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:26.113101006 CET	47840	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:26.115221977 CET	47838	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:26.118205070 CET	39	47840	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:26.118311882 CET	47840	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:26.118865967 CET	47840	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:26.123632908 CET	39	47840	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:26.123702049 CET	47840	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:26.129153967 CET	39	47840	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:27.779236078 CET	39	47840	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:27.779860973 CET	47842	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:27.782993078 CET	47840	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:27.784624100 CET	39	47842	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:27.784735918 CET	47842	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:27.785219908 CET	47842	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:27.789928913 CET	39	47842	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:27.790004969 CET	47842	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:27.794791937 CET	39	47842	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:29.411695957 CET	39	47842	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:29.412319899 CET	47844	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:29.414776087 CET	47842	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:29.417085886 CET	39	47844	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:29.417181015 CET	47844	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:29.417562008 CET	47844	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:29.422245026 CET	39	47844	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:29.422338963 CET	47844	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:29.427025080 CET	39	47844	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:31.081737041 CET	39	47844	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:31.082381010 CET	47846	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:31.082554102 CET	47844	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:31.087142944 CET	39	47846	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:31.087268114 CET	47846	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:31.087742090 CET	47846	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:31.092458963 CET	39	47846	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:31.092550039 CET	47846	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:31.097237110 CET	39	47846	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:32.728168964 CET	39	47846	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:32.728768110 CET	47848	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:32.730329990 CET	47846	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:32.734724045 CET	39	47848	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:32.734859943 CET	47848	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:32.735317945 CET	47848	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:32.740825891 CET	39	47848	196.251.81.246	192.168.2.23
Mar 12, 2025 01:21:32.740894079 CET	47848	39	192.168.2.23	196.251.81.246
Mar 12, 2025 01:21:32.745949030 CET	39	47848	196.251.81.246	192.168.2.23

System Behavior

Analysis Process: dash PID: 6225, Parent PID: 4331

General

Start time (UTC):	00:17:58
Start date (UTC):	12/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6225, Parent PID: 4331

General

Start time (UTC):	00:17:58
Start date (UTC):	12/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6226, Parent PID: 4331

General

Start time (UTC):	00:17:58
Start date (UTC):	12/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6226, Parent PID: 4331

General

Start time (UTC):	00:17:58
Start date (UTC):	12/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.OgBmfelDMw /tmp/tmp.LJTZ22AVWi /tmp/tmp.ayIspZznGR
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: demon.x86.elf PID: 6252, Parent PID: 6154

General

Start time (UTC):	00:17:59
Start date (UTC):	12/03/2025
Path:	/tmp/demon.x86.elf
Arguments:	/tmp/demon.x86.elf
File size:	30240 bytes
MD5 hash:	accf5b6999867c3bbe5ac612359a58a3

Chronological Activities

Analysis Process: demon.x86.elf PID: 6253, Parent PID: 6252

General

Start time (UTC):	00:17:59
Start date (UTC):	12/03/2025
Path:	/tmp/demon.x86.elf
Arguments:	-
File size:	30240 bytes
MD5 hash:	accf5b6999867c3bbe5ac612359a58a3

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report demon.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6225, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6225, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6226, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6226, Parent PID: 4331

General

Chronological Activities

Analysis Process: demon.x86.elf PID: 6252, Parent PID: 6154

General

Chronological Activities

Analysis Process: demon.x86.elf PID: 6253, Parent PID: 6252

General

Chronological Activities

Linux Analysis Report
demon.x86.elf