StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:06.470037 1.992538 arp 0.0.0.0 who 10.0.2.16 INT 3 126 flow=Background-ARP 1970/01/01 01:00:06.470181 0.000000 ipv6-icmp :: 135 -> ff02::1:ff56:8562 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:06.475533 3.990149 ipv6-icmp fe80::6dd3:1409:3456:8562 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:06.475587 0.494588 ipv6-icmp fe80::6dd3:1409:3456:8562 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:06.519653 3.004626 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:00:06.702765 2.766314 arp 10.0.2.16 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:07.720914 0.090625 udp fe80::6dd3:1409:3456:8562 50791 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:00:07.721218 0.090645 udp 10.0.2.16 54326 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:00:07.721398 0.000140 arp 10.0.2.2 who 10.0.2.16 CON 2 84 flow=Background-ARP 1970/01/01 01:00:07.811863 0.000000 icmp 10.0.2.2 0x000b -> 10.0.2.16 0x0000 TXD 192 1 92 flow=Background 1970/01/01 01:00:08.024213 0.075112 udp 10.0.2.16 50005 <-> 8.8.8.8 53 CON 0 0 2 257 flow=From-Botnet-V1-DNS 1970/01/01 01:00:08.101208 0.074571 udp 10.0.2.16 51357 <-> 8.8.8.8 53 CON 0 0 2 257 flow=From-Botnet-V1-DNS 1970/01/01 01:00:08.176495 0.279820 tcp 10.0.2.16 49161 -> 193.45.10.144 80 FSPA* 0 0 10 832 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:00:13.529697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:14.471151 0.000000 ipv6-icmp fe80::6dd3:1409:3456:8562 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:21.531616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:37.534645 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:01:09.540225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:04:55.083813 0.000146 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:04:55.084121 0.178219 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:04:58.259530 0.506579 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 959 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:04:58.766764 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:04:58.767694 0.000000 tcp 10.0.2.16 49162 -> 66.148.64.18 13606 S_ 0 1 66 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:05:07.052091 0.170951 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 534 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.227493 0.316517 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.544410 0.280048 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1239 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.825053 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:16.205714 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:25.108357 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:28.763172 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:30.475850 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:33.770852 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:36.173851 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:38.466906 0.000182 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:05:38.777645 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:44.666104 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:50.444670 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:56.814003 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:03.013013 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 302 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:10.152574 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:16.231988 0.204318 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:16.436306 0.000000 icmp 95.57.211.247 0x0303 -> 10.0.2.16 0x6a50 URP 192 1 164 flow=Background 1970/01/01 01:06:20.968348 0.000164 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:06:24.273206 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:33.085653 0.167706 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:06:33.254034 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:33.254611 0.000000 tcp 10.0.2.16 49163 -> 66.148.64.18 13606 S_ 0 1 66 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:06:52.213329 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:03.249304 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:07.965489 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:07:08.256792 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:09.473148 0.095088 udp fe80::6dd3:1409:3456:8562 59045 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:07:09.473458 0.095151 udp 10.0.2.16 51914 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:09.473619 0.094990 icmp 10.0.2.2 0x000b -> 10.0.2.16 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:07:09.768730 1.501463 udp 10.0.2.16 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:12.051039 0.073846 udp 10.0.2.16 64271 <-> 8.8.8.8 53 CON 0 0 2 244 flow=From-Botnet-V1-DNS 1970/01/01 01:07:12.125559 0.214487 tcp 10.0.2.16 49164 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:12.341728 0.076883 udp 10.0.2.16 57037 <-> 8.8.8.8 53 CON 0 0 2 162 flow=From-Botnet-V1-DNS 1970/01/01 01:07:12.419242 0.284755 tcp 10.0.2.16 49165 -> 173.194.70.94 80 SRPA* 0 0 27 20494 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:12.762606 0.117465 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 576 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:07:12.879716 0.090947 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:07:12.971255 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:13.263714 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:13.547849 3.000645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:07:20.553652 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:28.555426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:30.097577 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:44.558415 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:47.845313 0.166163 tcp 10.0.2.16 49166 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:48.011872 0.203377 tcp 10.0.2.16 49167 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:16.564877 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:20.572159 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:14:27.578095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:35.579737 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:51.582111 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:15:23.588568 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:27.595902 3.000191 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:21:34.601774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:42.603684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:58.606385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:30.612760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:34.619443 3.000280 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:28:41.626220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:49.627043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:05.630316 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:37.636397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:41.643895 2.999882 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:35:48.649650 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:56.651296 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:12.654305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:44.660055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:37:49.433590 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:37:49.433930 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:05.326831 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:23.056501 0.168052 tcp 10.0.2.16 49168 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:23.224825 0.201719 tcp 10.0.2.16 49169 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:23.427598 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:40.897929 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:55.901641 0.167542 tcp 10.0.2.16 49170 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:56.069938 0.197554 tcp 10.0.2.16 49171 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:56.268411 0.181275 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:38:56.450320 0.106412 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 605 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:38:56.450875 3.003006 tcp 10.0.2.16 49172 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:38:56.556285 0.091309 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 268 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:39:05.452598 0.000000 tcp 10.0.2.16 49172 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:39:12.765767 0.074029 udp 10.0.2.16 51898 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 01:39:12.840434 0.073788 udp 10.0.2.16 58451 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 01:39:17.450171 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:39:22.457502 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:39:27.464276 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:42:48.667646 3.000334 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:42:55.673791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:03.675491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:19.678318 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:51.684653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:49:55.691922 3.000058 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:50:02.697816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:10.699342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:26.702586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:58.708103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:02.715952 3.000416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:57:09.721694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:17.722818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:33.725949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:58:05.732110 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:09.739596 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:04:16.746081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:24.746792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:40.750286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:05:12.756012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:09:21.684071 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:09:21.684424 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:09:40.401156 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:09:57.589853 0.167331 tcp 10.0.2.16 49173 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:09:57.757384 0.202819 tcp 10.0.2.16 49174 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:09:57.961109 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:14.831058 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:32.397568 0.166713 tcp 10.0.2.16 49175 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:10:32.564117 0.195640 tcp 10.0.2.16 49176 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:10:32.760659 0.648867 rtcp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:32.852660 1.376766 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:32.853188 2.987424 tcp 10.0.2.16 49177 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:10:33.019474 0.707084 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2081 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:34.229987 0.170895 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 372 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:37.403106 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:41.839049 0.000000 tcp 10.0.2.16 49177 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:10:52.748624 0.074208 udp 10.0.2.16 55140 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 02:10:52.823565 0.073162 udp 10.0.2.16 54706 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 02:10:53.847053 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:58.854005 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:11:03.860879 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:11:16.763728 2.999796 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 02:11:23.769654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:31.771077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:47.774160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:12:19.780396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:23.787376 3.000685 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:18:30.793596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:38.795285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:54.798134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:19:26.804145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:25:30.811412 3.000042 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:25:37.817779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:25:45.818991 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:01.822275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:33.828096 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:37.835429 3.000648 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:32:44.841259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:52.842716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:08.845865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:40.852600 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:39:44.859941 3.000154 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:39:51.865306 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:39:59.867303 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:15.869748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:46.724866 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:40:46.725207 0.107011 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:46.831491 0.092087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:46.832626 2.996459 tcp 10.0.2.16 49178 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:40:46.924102 0.240855 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 289 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:47.165476 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:40:47.875675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:55.837482 0.000000 tcp 10.0.2.16 49178 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:41:04.420462 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:07.718167 0.074195 udp 10.0.2.16 54152 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 02:41:07.793004 0.073150 udp 10.0.2.16 51034 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 02:41:07.835056 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:12.842093 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:17.849062 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:20.937561 0.182779 tcp 10.0.2.16 49179 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:41:21.120636 0.202623 tcp 10.0.2.16 49180 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:46:51.884013 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:46:58.889258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:06.890945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:22.893604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:54.899830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:53:58.907455 3.000247 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:54:05.913657 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:13.914667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:29.917928 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:55:01.923844 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:05.931427 3.000204 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:01:12.937788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:20.938762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:36.941827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:02:08.948118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:12.955766 2.999822 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:08:19.961455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:27.962487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:43.966192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:09:15.971995 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:11:49.612892 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:11:49.613234 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:07.779627 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:26.610984 0.165352 tcp 10.0.2.16 49181 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:12:26.776612 0.230531 tcp 10.0.2.16 49182 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:12:27.008075 4.897785 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.114252 3.880337 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.115208 2.985863 tcp 10.0.2.16 49183 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:12:27.205778 4.594067 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1696 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.468235 0.258841 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 635 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:32.012609 0.106597 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 880 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:32.117973 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:36.099901 0.000000 tcp 10.0.2.16 49183 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:12:38.693312 0.263652 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 586 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:48.107268 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:53.114268 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:58.121384 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:15:19.979508 3.000339 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:15:26.985675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:34.986891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:50.989862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:16:22.996186 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:27.003839 2.999918 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:22:34.009444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:42.011046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:58.013622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:23:30.019515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:34.027438 2.999957 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:29:41.033135 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:49.034695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:05.037697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:37.044113 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:41.051521 2.999873 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:36:48.056887 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:56.058379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:12.061535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:44.067998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:42:50.248434 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:42:50.248746 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:05.650173 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:21.727894 0.165886 tcp 10.0.2.16 49184 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:21.894140 0.195949 tcp 10.0.2.16 49185 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:22.091048 0.262147 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 213 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.354393 0.092552 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.354939 3.003410 tcp 10.0.2.16 49186 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:43:22.447534 0.106809 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.553420 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:31.367319 0.000000 tcp 10.0.2.16 49186 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:43:39.789221 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:43.364486 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:48.075066 3.000427 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:43:48.371807 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:53.379488 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:55.081085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:43:58.478489 0.166173 tcp 10.0.2.16 49187 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:58.645206 0.199810 tcp 10.0.2.16 49188 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:44:03.082825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:19.086037 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:51.091827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:50:55.098993 3.000686 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:51:02.105358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:10.106864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:26.109345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:58.115639 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:02.122724 3.000617 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:58:09.129111 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:17.130685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:33.133520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:59:05.139849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:09.147361 3.000143 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:05:16.153325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:24.154876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:40.157762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:06:12.164049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:16.171221 3.000164 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:12:23.177433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:31.178499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:47.181893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:13:19.187363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:14:18.823499 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:14:18.823818 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:14:34.296148 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:14:52.165643 0.167440 tcp 10.0.2.16 49189 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:14:52.333408 0.225127 tcp 10.0.2.16 49190 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:14:52.559545 4.854034 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:52.653815 4.449659 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1393 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:52.654357 3.002202 tcp 10.0.2.16 49191 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:14:52.924988 4.809715 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:53.041537 0.265334 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:57.733960 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:01.654758 0.000000 tcp 10.0.2.16 49191 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:15:04.419105 0.260786 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 557 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:15:13.652131 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:18.659532 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:23.666894 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:19:23.195153 2.999701 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 04:19:30.200663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:38.202547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:54.205133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:20:26.211654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:26:30.218925 3.000017 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:26:37.225359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:26:45.226513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:01.229583 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:33.235724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:37.243333 2.999564 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:33:44.248990 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:52.250090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:08.253417 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:40.259815 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:40:44.267122 2.999711 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:40:51.272718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:40:59.274127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:15.277964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:47.284473 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:45:25.767912 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:45:25.768248 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:45:42.591999 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:45:58.880216 1.847634 tcp 10.0.2.16 49192 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:45:59.122811 0.310321 tcp 10.0.2.16 49193 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:45:59.434072 0.203194 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:45:59.637814 0.232060 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 716 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:45:59.638356 2.992187 tcp 10.0.2.16 49194 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:45:59.868976 0.357234 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 303 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:46:00.226799 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:08.628782 0.000000 tcp 10.0.2.16 49194 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:46:18.212821 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:20.636380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:25.643911 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:30.651440 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:33.276872 0.229990 tcp 10.0.2.16 49195 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:46:33.507510 0.265314 tcp 10.0.2.16 49196 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:47:51.291117 3.000382 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 04:47:58.297077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:06.298305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:22.301336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:54.307623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:54:58.315510 2.999572 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:55:05.320598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:13.322459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:29.325477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:56:01.331719 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:05.338540 3.000829 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:02:12.344545 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:20.346393 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:36.349063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:03:08.355466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:12.362293 3.000835 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:09:19.368421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:27.369948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:43.373566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:10:15.379499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:19.387401 2.999321 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:16:26.392476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:34.394319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:50.397337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:52.000412 0.000110 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:16:52.000725 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:08.683644 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:22.403298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:17:23.739912 0.180165 tcp 10.0.2.16 49197 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:17:23.920316 0.221124 tcp 10.0.2.16 49198 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:17:24.142327 4.948137 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 402 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.252192 4.035527 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2083 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.252714 2.987301 tcp 10.0.2.16 49199 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:17:24.364355 4.725618 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.633912 0.270365 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 621 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:29.184651 0.202976 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 938 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:29.388187 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:33.238574 0.000000 tcp 10.0.2.16 49199 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:17:36.113693 0.283552 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 532 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:45.246645 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:50.253439 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:55.260831 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:23:26.410454 3.000180 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:23:33.416494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:41.418487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:57.421274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:24:29.427512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:33.434265 3.000517 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:30:40.440887 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:48.441975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:04.445649 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:36.450844 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:37:40.458523 3.000552 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:37:47.464462 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:37:55.466081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:11.468852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:43.474874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:44:47.482189 3.000927 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:44:54.488870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:02.489833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:18.493287 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:50.499095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:48:08.257468 0.000123 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:48:08.257793 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:25.021439 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:42.190118 0.776243 tcp 10.0.2.16 49200 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:48:42.966639 0.207145 tcp 10.0.2.16 49201 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:48:43.174804 0.147994 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 747 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.322030 0.105008 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.323009 2.998502 tcp 10.0.2.16 49202 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:48:43.427613 0.277615 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 274 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.705746 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:52.320177 0.000000 tcp 10.0.2.16 49202 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:49:02.064953 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:04.327750 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:09.335464 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:14.342339 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:17.909638 0.940328 tcp 10.0.2.16 49203 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:49:18.850270 0.230547 tcp 10.0.2.16 49204 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:51:54.506174 3.000790 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:52:01.512962 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:09.514100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:25.517100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:57.522824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:01.531085 2.999777 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:59:08.536315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:16.537621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:32.541176 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:00:04.546797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:08.555129 2.999332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:06:15.560245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:23.561916 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:39.565025 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:07:11.571526 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:15.578429 2.999898 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:13:22.584099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:30.586301 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:46.589134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:14:18.594735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:19:31.144948 0.000120 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:19:31.145269 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:19:49.821129 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:07.861755 0.310342 tcp 10.0.2.16 49205 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:20:08.172376 0.207409 tcp 10.0.2.16 49206 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:20:08.380688 4.934302 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.473421 4.030870 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2153 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.473970 2.998661 tcp 10.0.2.16 49207 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:20:08.626296 4.688125 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1751 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.893862 0.265091 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:13.414503 0.204119 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 928 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:13.619171 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:17.470807 0.000000 tcp 10.0.2.16 49207 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:20:21.266595 0.285053 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:22.602468 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 06:20:29.478835 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:29.608560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:34.486013 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:37.610026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:39.492617 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:53.612704 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:21:25.618905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:29.626095 3.000512 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:27:36.632566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:44.633932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:00.636614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:32.643125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:34:36.650211 3.000013 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:34:43.656623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:34:51.657484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:07.660918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:39.666781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:41:43.674857 2.999311 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:41:50.680164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:41:58.681620 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:14.685237 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:46.690469 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:48:50.698299 3.000263 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:48:57.704454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:05.706088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:21.708772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:53.715019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:50:38.379814 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:50:38.380132 0.110412 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:50:38.490061 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:50:38.491163 3.002095 tcp 10.0.2.16 49208 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:50:47.492294 0.000000 tcp 10.0.2.16 49208 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:50:53.641130 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:50:59.489475 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:04.496741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:09.504323 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:09.598427 0.194091 tcp 10.0.2.16 49209 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:09.792782 0.202209 tcp 10.0.2.16 49210 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:09.996369 0.097486 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 358 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:51:10.094371 0.277659 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 210 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:51:10.372550 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:26.548967 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:44.045808 0.167012 tcp 10.0.2.16 49211 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:44.213127 0.211853 tcp 10.0.2.16 49212 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:55:57.722257 3.000515 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 06:56:04.727886 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:12.729642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:28.732954 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:57:00.738816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:04.746713 2.999524 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:03:11.751984 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:19.754067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:35.756409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:04:07.763123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:11.770408 2.999844 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:10:18.776256 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:26.777388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:42.780992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:11:14.786654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:18.793704 3.000705 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:17:25.800527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:33.801714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:49.804853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:18:21.810434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:22:10.429666 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:22:10.429985 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:27.203424 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:44.232718 0.180904 tcp 10.0.2.16 49213 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:22:44.414128 0.194654 tcp 10.0.2.16 49214 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:22:44.609751 4.342942 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2142 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:44.716699 3.917384 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:44.717700 2.995570 tcp 10.0.2.16 49215 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:22:44.812183 4.935246 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1419 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:45.078932 0.264692 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 594 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:49.747952 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:53.711548 0.000000 tcp 10.0.2.16 49215 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:22:55.214264 0.280410 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:23:05.709061 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:23:10.716034 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:23:15.723867 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:24:25.817704 3.000291 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 07:24:32.824426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:40.825253 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:56.828975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:25:28.834455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:32.841829 3.000145 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:31:39.848199 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:47.849841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:03.852595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:35.858337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:38:39.865618 3.000811 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:38:46.872022 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:38:54.873634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:10.877330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:42.882761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:45:46.889799 3.000587 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:45:53.895840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:01.897322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:17.900623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:49.906679 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:52:53.913973 3.000349 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:53:00.919932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:08.921885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:16.542472 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:53:16.542786 0.091519 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 222 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:16.634925 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:16.635807 3.001426 tcp 10.0.2.16 49216 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:24.924692 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:25.635521 0.000000 tcp 10.0.2.16 49216 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:35.159247 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:37.632701 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:42.640407 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:47.647436 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:53.079361 0.190227 tcp 10.0.2.16 49217 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:53:53.269777 0.218255 tcp 10.0.2.16 49218 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:53:53.488923 0.264380 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:53.753894 0.108415 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 666 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:53.754441 2.995860 tcp 10.0.2.16 49219 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:53.861306 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:56.930826 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:54:02.748977 0.000000 tcp 10.0.2.16 49219 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:54:11.351494 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:14.756211 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:19.763898 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:24.770342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:29.670180 0.190623 tcp 10.0.2.16 49220 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:54:29.861223 0.229249 tcp 10.0.2.16 49221 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:00:00.937992 3.000112 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:00:07.944118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:15.945659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:31.948206 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:01:03.954503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:07.962221 3.000032 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:07:14.968152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:22.969322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:38.972254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:08:10.978191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:14.985716 3.000200 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:14:21.991959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:29.993563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:45.996332 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:15:18.002750 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:22.009498 3.000878 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:21:29.015862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:37.017340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:53.020361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:22:25.026162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:24:33.841495 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:24:33.841816 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:24:51.897639 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:07.204404 0.202408 tcp 10.0.2.16 49222 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:25:07.407547 0.226347 tcp 10.0.2.16 49223 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:25:07.634790 4.005076 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:07.726296 4.759524 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1252 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:07.726858 2.997945 tcp 10.0.2.16 49224 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:07.992416 3.964694 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1996 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:08.099581 0.266853 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 658 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:12.749639 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:12.750163 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:16.723356 0.000000 tcp 10.0.2.16 49224 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:20.508640 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:28.089911 0.267062 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 456 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:28.720667 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:31.354711 0.797125 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1313 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:32.152403 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:33.727618 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:38.734772 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:40.278582 0.311382 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.592175 0.317034 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.908874 0.273909 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.909753 3.006555 tcp 10.0.2.16 49225 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:44.183430 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:48.959684 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:25:51.183642 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:52.915347 0.000000 tcp 10.0.2.16 49225 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:57.371551 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:03.390513 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:04.913292 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:08.467601 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:09.919856 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:14.927421 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:15.227161 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:21.907138 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:30.589519 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:35.466250 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:26:37.249151 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:44.159083 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:52.430898 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:27:00.603084 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:28:29.034165 3.000111 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 08:28:36.039662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:28:44.041248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:00.044386 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:32.050019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:35:36.057811 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:35:43.063761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:35:51.065156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:07.068249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:39.074263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:42:43.081504 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:42:50.088031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:42:58.089160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:14.092439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:46.098314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:49:50.105701 2.999906 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:49:57.111612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:05.113183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:21.116233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:53.122183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:56:57.130101 2.999765 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:57:04.135340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:10.415138 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:57:10.415459 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:12.137482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:28.140397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:28.721594 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:46.390409 1.461882 tcp 10.0.2.16 49226 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:57:47.852680 1.458730 tcp 10.0.2.16 49227 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:57:49.312382 0.951287 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 403 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:57:50.264270 0.774731 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 645 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:57:50.264816 3.001078 tcp 10.0.2.16 49228 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:57:51.038357 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:59.264668 0.000000 tcp 10.0.2.16 49228 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:58:00.146219 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:58:08.047827 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:11.262369 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:16.269532 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:21.277768 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:23.061471 0.892598 tcp 10.0.2.16 49229 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:58:23.953954 0.997001 tcp 10.0.2.16 49230 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:58:24.952152 0.550015 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 249 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:04:04.151354 3.002819 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:04:11.159796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:19.160785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:35.164453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:05:07.170364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:11.177794 3.000282 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:11:18.183587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:26.185380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:42.188115 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:12:14.193810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:18.201321 3.000353 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:18:25.207184 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:33.208931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:49.211869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:19:21.218337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:25.225720 2.999896 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:25:32.231270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:40.232646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:56.236378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:26:28.241707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:28:52.409843 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:28:52.410192 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:09.594370 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:24.690418 1.077937 tcp 10.0.2.16 49231 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:29:25.768764 1.183362 tcp 10.0.2.16 49232 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:29:26.953076 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:45.646384 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:01.860967 0.767655 tcp 10.0.2.16 49233 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:30:02.629158 0.901449 tcp 10.0.2.16 49234 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:30:03.531782 0.663874 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 290 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:04.196259 0.484134 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:04.196806 3.000015 tcp 10.0.2.16 49235 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 09:30:04.679457 0.482894 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 293 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:05.163062 0.678650 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 695 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:08.839662 0.780561 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 501 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:12.624549 1.062911 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1532 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:13.195108 0.000000 tcp 10.0.2.16 49235 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 09:30:13.686543 1.567073 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1091 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:15.254130 1.210887 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1129 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:16.465534 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:23.440302 0.266255 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 699 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:25.193014 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:30.199910 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:35.207485 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:32:32.249382 3.000531 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 09:32:39.255723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:32:47.257287 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:03.259917 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:35.266137 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:39:39.273029 3.001666 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:39:46.280720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:39:54.281640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:10.284248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:42.290112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:46:46.297169 3.000092 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:46:53.303374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:01.304845 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:17.307983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:49.314395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:53:53.321029 3.000921 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:54:00.327898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:08.328694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:24.332262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:56.337566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:00:50.877922 0.000200 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:00:50.878337 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:00.345191 3.000428 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:01:07.271511 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:07.350986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:15.353079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:24.139818 1.919244 tcp 10.0.2.16 49236 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:24.332017 0.224049 tcp 10.0.2.16 49237 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:24.557035 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:31.355894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:41.160217 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:58.797173 0.190245 tcp 10.0.2.16 49238 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:58.987705 0.221851 tcp 10.0.2.16 49239 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:59.210483 0.107294 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.317282 0.264000 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.318251 2.992059 tcp 10.0.2.16 49240 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:01:59.581800 0.094470 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.676893 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:03.361986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:02:08.309247 0.000000 tcp 10.0.2.16 49240 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:02:15.629687 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:20.316751 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:25.323588 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:30.330675 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:33.186807 0.187598 tcp 10.0.2.16 49241 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:02:33.374793 0.212157 tcp 10.0.2.16 49242 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:08:07.369300 3.000495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:08:14.375305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:22.377000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:38.380308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:09:10.386052 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:14.393263 3.000125 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:15:21.399008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:29.400592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:45.403458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:16:17.410173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:21.417088 3.000821 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:22:28.423484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:36.424863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:52.427420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:23:24.433718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:28.441467 3.000044 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:29:35.446884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:43.449380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:59.451791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:30:31.457536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:32:39.021504 0.000176 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:32:39.021845 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:32:54.933891 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:13.835780 0.185287 tcp 10.0.2.16 49243 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:33:14.021496 0.218418 tcp 10.0.2.16 49244 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:33:14.240806 4.816709 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1358 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.506371 3.753513 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.506906 2.999562 tcp 10.0.2.16 49245 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:14.608208 3.918166 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.697218 0.263402 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:19.313974 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:19.314530 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:23.504947 0.000000 tcp 10.0.2.16 49245 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:26.199533 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:35.112150 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:35.502342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 112 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:40.509602 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:43.413549 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:45.517142 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:50.233451 0.274164 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 670 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:53.508602 0.782218 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1069 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:54.291711 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:54.292282 3.001630 tcp 10.0.2.16 49246 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:55.460724 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:34:01.590240 0.266556 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:03.292678 0.000000 tcp 10.0.2.16 49246 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:34:04.855383 0.302378 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1773 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:05.157459 0.274649 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:05.432679 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:13.617145 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:15.290015 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:19.746630 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:20.296916 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:25.304124 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:28.177925 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:34.647547 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:39.464330 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:34:42.689280 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:49.729376 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:56.419032 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 296 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:04.009497 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:11.210061 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:18.440867 0.185601 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:18.626468 0.000000 icmp 95.57.211.247 0x0303 -> 10.0.2.16 0x6a50 URP 192 1 213 flow=Background 1970/01/01 10:35:22.966604 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:35:25.470481 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 311 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:36:35.465149 3.000187 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 10:36:42.471450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:36:50.472525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:06.475775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:38.481406 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:43:42.489316 2.999795 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:43:49.495502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:43:57.496831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:13.499749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:45.505313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:50:49.513084 3.000457 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:50:56.519325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:04.520770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:20.523441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:52.529432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:57:56.537057 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:58:03.542865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:11.544758 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:27.548078 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:59.553305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:03.560839 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:05:10.567148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:18.568957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:34.571738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:55.451954 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:05:55.452305 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:06.577229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:06:12.756780 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:31.327456 1.935256 tcp 10.0.2.16 49247 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:06:31.509771 0.219266 tcp 10.0.2.16 49248 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:06:31.729965 0.270753 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 286 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:06:32.001332 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:32.001874 2.996575 tcp 10.0.2.16 49249 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:06:41.006628 0.000000 tcp 10.0.2.16 49249 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:06:48.588519 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:53.004602 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:58.011826 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:07:03.018929 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:07:04.913603 0.183105 tcp 10.0.2.16 49250 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:07:05.096991 0.212483 tcp 10.0.2.16 49251 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:07:05.310402 0.094233 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:07:05.405173 0.100255 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 608 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:12:10.584517 3.001055 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 11:12:17.590789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:25.592454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:41.595522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:13:13.601268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:17.608682 3.000820 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:19:24.614809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:32.616712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:48.619553 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:20:20.625595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:24.633099 2.999691 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:26:31.638748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:39.640622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:55.643121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:27:27.649165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:31.656540 3.000208 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:33:38.662893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:46.664712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:02.667103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:34.673274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:37:27.482231 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:37:27.482584 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:37:45.818853 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:04.569610 0.183371 tcp 10.0.2.16 49252 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:04.753264 0.220339 tcp 10.0.2.16 49253 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:04.974486 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:23.923160 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:41.710790 0.181596 tcp 10.0.2.16 49254 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:41.892300 0.221876 tcp 10.0.2.16 49255 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:42.115038 0.262630 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.378268 0.101801 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.378807 3.004857 tcp 10.0.2.16 49256 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:38:42.479003 0.090521 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 209 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.570233 0.261693 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 508 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:45.835049 0.264365 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 547 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.099211 0.301469 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.399832 0.272203 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1350 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.672571 0.785976 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1173 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:50.459090 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:51.382232 0.000000 tcp 10.0.2.16 49256 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:38:58.212655 0.259047 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:39:03.379752 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:39:08.387597 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:39:13.394319 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:40:38.680891 3.000410 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 11:40:45.686898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:40:53.688366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:09.691443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:41.697289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:47:45.704985 3.000071 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:47:52.710771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:00.712775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:16.715393 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:48.721189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:54:52.728663 3.000406 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:54:59.734755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:07.736523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:23.739743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:55.745371 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:01:59.752699 3.000582 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:02:06.758727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:14.759959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:30.763035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:03:02.769168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:06.776716 3.000008 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:09:13.782653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:16.947776 0.000161 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:09:16.948086 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:21.784489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:32.620247 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:37.786831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:47.986019 0.184646 tcp 10.0.2.16 49257 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:09:48.171027 0.211698 tcp 10.0.2.16 49258 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:09:48.383817 0.102205 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 759 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:09:48.485598 0.090845 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 353 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:09:48.486533 3.000681 tcp 10.0.2.16 49259 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:09:48.576969 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:57.485351 0.000000 tcp 10.0.2.16 49259 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:06.609078 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:09.482971 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:09.793574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:10:14.490072 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:19.497081 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:24.877395 0.183199 tcp 10.0.2.16 49260 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:25.061045 0.217546 tcp 10.0.2.16 49261 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:25.279614 0.243806 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:10:25.523974 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:25.524540 2.995386 tcp 10.0.2.16 49262 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:34.518576 0.000000 tcp 10.0.2.16 49262 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:42.349884 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:46.526770 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:51.533413 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:56.540655 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:58.085370 0.183205 tcp 10.0.2.16 49263 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:58.268788 0.218237 tcp 10.0.2.16 49264 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:16:13.800366 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 12:16:20.806485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:28.808548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:44.810943 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:17:16.817708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:20.825083 2.999986 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:23:27.830434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:35.831982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:51.835159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:24:23.841113 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:27.848932 2.999654 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:30:34.854929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:42.856057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:58.859142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:31:30.865151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:34.872319 3.000875 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:37:41.879142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:49.880852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:05.883477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:37.889339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:41:12.331207 0.000241 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:41:12.331612 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:29.656215 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:45.723574 1.982036 tcp 10.0.2.16 49265 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:41:45.907680 0.214338 tcp 10.0.2.16 49266 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:41:46.122938 4.713587 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2039 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.224486 3.752384 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1680 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.225460 2.999074 tcp 10.0.2.16 49267 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:41:46.315758 4.216840 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1408 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.509060 0.194937 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 474 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:50.836022 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:55.222841 0.000000 tcp 10.0.2.16 49267 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:41:57.686759 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:04.146172 0.214527 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 420 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:07.219987 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:07.360998 0.620592 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:07.982169 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 312 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:12.227163 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:16.754354 0.193542 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:17.234740 3.015663 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:20.249596 0.267742 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:20.517903 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:28.590741 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:33.457700 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:42:35.380733 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:44.133574 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:52.685600 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:59.004379 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:04.702615 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:09.840622 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:17.511121 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:22.458663 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:43:26.173835 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:34.435694 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:39.783421 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:44:41.897058 2.999823 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 12:44:48.902712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:44:56.903854 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:12.907385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:44.912853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:51:48.920682 3.000342 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:51:55.926602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:03.928453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:19.930749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:51.937323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:58:55.944462 3.000565 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:59:02.950749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:10.951910 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:26.954618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:58.961467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:02.968833 3.000023 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:06:09.974621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:17.975605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:33.979589 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:07:05.985418 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:09.992608 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:13:16.998610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:24.999637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:41.003165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:58.377852 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:13:58.378159 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:13.009104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:14:16.243619 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:31.950888 0.191708 tcp 10.0.2.16 49268 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:14:32.142987 0.226737 tcp 10.0.2.16 49269 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:14:32.370651 0.170709 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.541944 0.105782 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 542 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.542509 2.998746 tcp 10.0.2.16 49270 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:14:32.646867 0.093387 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.740769 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:41.539871 0.000000 tcp 10.0.2.16 49270 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:14:49.872140 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:53.547952 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:58.554604 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:15:03.561922 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:15:05.767372 0.192437 tcp 10.0.2.16 49271 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:15:05.960183 0.222543 tcp 10.0.2.16 49272 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:20:17.016447 3.000214 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:20:24.022656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:32.024355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:48.026972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:21:20.033265 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:24.040111 3.000689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:27:31.046476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:39.047441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:55.050876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:28:27.056946 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:31.064830 2.999328 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:34:38.070331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:46.071769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:02.074833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:34.081086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:41:38.088271 3.000460 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:41:45.094435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:41:53.095714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:09.098787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:41.104654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:45:09.608292 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:45:09.608636 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:45:27.684416 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:45:46.626422 0.189265 tcp 10.0.2.16 49273 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:45:46.816212 0.225398 tcp 10.0.2.16 49274 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:45:47.042566 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:03.466067 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:21.533682 0.191349 tcp 10.0.2.16 49275 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:46:21.725464 0.219773 tcp 10.0.2.16 49276 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:46:21.946139 0.106683 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 595 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.052490 0.169168 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 320 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.053350 3.003230 tcp 10.0.2.16 49277 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:46:22.222187 0.092450 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 323 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.315388 0.168543 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 517 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:25.487569 0.168507 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 548 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:28.652336 0.509564 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1226 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.162516 0.276538 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1090 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.439745 0.315972 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1639 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.754828 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:31.055530 0.000000 tcp 10.0.2.16 49277 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:46:35.121455 0.168467 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:43.052908 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:48.060327 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:53.067457 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:48:45.112448 3.000282 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:48:52.118294 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:00.119988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:16.122889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:48.128513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:55:52.136646 2.999818 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:55:59.142491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:07.143787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:23.147013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:55.152572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:02:59.160109 3.000526 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:03:06.166012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:14.167774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:30.170885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:04:02.176484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:06.184356 2.999958 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:10:13.190534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:21.191966 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:37.194979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:11:09.200967 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:16:44.182533 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:16:44.182890 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:00.616332 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:13.208127 3.000280 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:17:15.682265 2.028200 tcp 10.0.2.16 49278 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:15.873844 0.228566 tcp 10.0.2.16 49279 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:16.103425 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:20.213767 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:28.215562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:33.823592 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:44.218882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:49.048096 0.192631 tcp 10.0.2.16 49280 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:49.241292 0.222168 tcp 10.0.2.16 49281 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:49.464350 0.090992 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 375 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.555993 0.106002 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 531 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.556529 2.994129 tcp 10.0.2.16 49282 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:17:49.661474 0.166955 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.828949 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:58.549157 0.000000 tcp 10.0.2.16 49282 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:18:08.265164 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:10.556380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:15.563559 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:16.224442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:18:20.570691 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:26.251520 0.190711 tcp 10.0.2.16 49283 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:18:26.442469 0.222236 tcp 10.0.2.16 49284 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:24:20.231906 3.000040 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:24:27.238363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:35.239376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:51.242202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:25:23.248374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:27.255997 3.000236 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:31:34.261964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:42.263952 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:58.266816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:32:30.273723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:34.280902 2.999383 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:38:41.286088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:49.287814 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:05.290768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:37.296330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:41.303483 3.000513 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:45:48.310337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:56.311757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:12.314562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:44.320448 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:48:54.698286 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:48:54.698603 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:11.011672 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:27.189262 0.191028 tcp 10.0.2.16 49285 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:49:27.380582 0.227838 tcp 10.0.2.16 49286 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:49:27.609336 4.147459 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.716229 3.722313 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1547 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.717205 2.992456 tcp 10.0.2.16 49287 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:49:27.813172 4.455540 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1671 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.985543 0.167151 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:32.269242 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:36.708079 0.000000 tcp 10.0.2.16 49287 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:49:40.193560 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:47.624197 0.167983 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 517 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:48.715685 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:50.789330 0.515618 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:51.305504 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:53.723085 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:57.337836 0.170897 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:58.730116 2.106856 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1771 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:50:00.836457 0.290087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:50:01.127067 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:08.263605 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:12.960414 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:50:15.194282 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:23.976722 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:31.407688 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:40.219617 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:46.779721 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:54.801033 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:59.456908 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:51:00.799113 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:09.231929 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:17.113247 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:23.832850 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:52:48.327665 3.000865 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 14:52:55.333899 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:03.335597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:19.338624 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:51.344647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:59:55.352252 2.999925 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:00:02.358015 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:10.359518 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:26.362498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:58.368275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:02.375826 3.000163 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:07:09.381954 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:17.383602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:33.386459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:08:05.392676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:09.400105 2.999985 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:14:16.406158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:24.407109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:40.410315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:15:12.416623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:16.423775 3.000569 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:21:23.430035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:31.431014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:46.093025 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:21:46.093364 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:21:47.434573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:22:03.868126 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:18.893709 0.190036 tcp 10.0.2.16 49288 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:19.084094 0.228142 tcp 10.0.2.16 49289 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:19.313135 0.169221 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:22:19.440134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:22:19.482950 0.107119 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:22:19.483538 3.000769 tcp 10.0.2.16 49290 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:22:19.589214 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:28.483336 0.000000 tcp 10.0.2.16 49290 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:22:37.476115 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:40.480675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:45.488354 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:50.494993 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:53.090923 0.192372 tcp 10.0.2.16 49291 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:53.283706 0.217576 tcp 10.0.2.16 49292 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:53.502197 0.092189 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 343 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:28:23.447969 2.999874 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:28:30.453938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:38.455299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:54.458555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:29:26.464159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:35:30.471898 3.000489 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:35:37.477757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:35:45.479289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:01.482062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:33.488521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:42:37.496275 2.999610 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:42:44.502079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:42:52.502825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:08.505827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:40.512035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:49:44.519378 3.000143 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:49:51.525547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:49:59.527439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:15.529778 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:47.536047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:53:09.580711 0.000183 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:53:09.581049 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:53:26.124066 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:53:45.065835 0.191857 tcp 10.0.2.16 49293 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:53:45.258153 0.222747 tcp 10.0.2.16 49294 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:53:45.481971 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:03.558013 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:19.873735 0.190445 tcp 10.0.2.16 49295 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:54:20.064603 0.223621 tcp 10.0.2.16 49296 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:54:20.289116 0.169806 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.459587 0.107577 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.460128 3.006243 tcp 10.0.2.16 49297 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:54:20.566309 0.090943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 238 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.657915 0.173409 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:23.827378 0.170218 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.001575 0.316363 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1577 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.317062 0.275464 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.593097 0.508024 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1162 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:28.101609 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:29.465282 0.000000 tcp 10.0.2.16 49297 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:54:35.003575 0.168017 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:41.462518 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:46.469613 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:51.477031 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:56:51.543828 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 15:56:58.549831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:06.551439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:22.554640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:54.560262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:03:58.567816 2.999716 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:04:05.573904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:13.575083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:29.578123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:05:01.584067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:05.591166 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:11:12.597567 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:20.599179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:36.601707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:12:08.608585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:12.615958 3.000172 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:18:19.621567 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:27.623246 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:43.625800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:19:15.632079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:24:45.236212 0.000175 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:24:45.236552 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:01.339820 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:19.639661 2.999739 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:25:19.870337 0.193531 tcp 10.0.2.16 49298 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:20.064301 0.235452 tcp 10.0.2.16 49299 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:20.300704 0.107127 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:20.407339 0.090273 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:20.408321 2.992363 tcp 10.0.2.16 49300 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:25:20.498120 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:26.645297 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:29.398998 0.000000 tcp 10.0.2.16 49300 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:25:34.646598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:37.761937 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:41.407032 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:46.414144 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:50.650193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:51.421453 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:55.819224 0.192107 tcp 10.0.2.16 49301 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:56.011714 0.223257 tcp 10.0.2.16 49302 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:56.236010 0.172817 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:56.409373 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:26:13.072406 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:26:22.655860 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:26:31.851649 0.191896 tcp 10.0.2.16 49303 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:26:32.044000 0.223289 tcp 10.0.2.16 49304 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:32:26.663112 3.000278 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:32:33.669581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:41.671040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:57.673563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:33:29.680094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:39:33.687128 3.000512 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:39:40.693747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:39:48.694852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:04.698391 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:36.703931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:40.711301 3.000493 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:46:47.717533 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:55.719491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:11.721508 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:43.727533 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:53:47.735361 3.000390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:53:54.741142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:02.742510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:18.745819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:50.752257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:56:44.155024 0.000176 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:56:44.155419 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:00.498967 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:15.735098 0.166567 tcp 10.0.2.16 49305 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:57:15.902065 0.199263 tcp 10.0.2.16 49306 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:57:16.102215 4.651478 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1994 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.208974 3.711240 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.209926 2.995203 tcp 10.0.2.16 49307 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:57:16.301902 4.132456 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1679 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.472463 0.175788 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 490 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:20.752881 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:25.203853 0.000000 tcp 10.0.2.16 49307 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:57:26.886382 0.174485 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:37.201459 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:42.208255 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:47.216026 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:00:54.759682 2.999753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 17:01:01.765555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:09.766729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:25.770117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:57.775987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:01.783204 3.000283 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:08:08.789307 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:16.790732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:32.793806 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:09:04.800030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:08.807083 3.000491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:15:15.813220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:23.815060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:39.817694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:16:11.823761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:15.831486 3.000079 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:22:22.837331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:30.838798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:46.841834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:23:18.847689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:27:59.080570 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:27:59.080891 0.091403 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 333 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:27:59.172931 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:27:59.173585 3.001326 tcp 10.0.2.16 49308 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 17:28:08.174774 0.000000 tcp 10.0.2.16 49308 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 17:28:15.163646 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:20.171079 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:25.177983 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:30.185268 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:33.658848 0.199277 tcp 10.0.2.16 49309 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:28:33.858582 0.206271 tcp 10.0.2.16 49310 -> 173.194.70.94 80 SRPA* 0 0 10 4836 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:28:34.065808 0.107568 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:28:34.180988 0.167749 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:28:34.349307 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:49.402859 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:29:04.857379 1.870941 tcp 10.0.2.16 49311 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:29:05.023657 0.202454 tcp 10.0.2.16 49312 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:29:22.855135 3.000529 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 17:29:29.860857 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:37.862410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:53.865288 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:30:25.871937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:36:29.879644 2.999596 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:36:36.884768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:36:44.886365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:00.889773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:32.895607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:43:36.903609 2.999439 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:43:43.909089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:43:51.910631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:07.913341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:39.919477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:50:43.927500 2.999495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:50:50.932818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:50:58.934551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:14.937628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:46.943743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:57:50.950967 3.000226 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:57:57.956680 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:05.958646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:21.961494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:53.967742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:59:33.674730 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:59:33.675073 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:59:48.867025 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:07.718337 1.909663 tcp 10.0.2.16 49313 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:00:07.884818 0.198160 tcp 10.0.2.16 49314 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:00:08.083920 4.641106 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.176361 3.771488 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.176893 2.991725 tcp 10.0.2.16 49315 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:00:08.283642 4.164058 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.452658 0.173744 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:12.725558 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:17.177127 0.000000 tcp 10.0.2.16 49315 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:00:19.881238 0.172622 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 600 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:29.175064 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:34.181627 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:39.189107 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:04:57.974503 3.000834 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:05:04.981002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:12.982211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:28.985158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:06:00.991208 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:04.999381 2.999596 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:12:12.005257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:20.006365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:36.019217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:13:08.025777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:12.032666 3.000197 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:19:19.039348 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:27.040373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:43.043463 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:20:15.049757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:19.056877 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:26:26.063108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:34.064355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:50.067435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:27:22.073701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:30:28.511750 0.000177 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:30:28.512093 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:30:46.066905 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:02.695075 0.167416 tcp 10.0.2.16 49316 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:02.862660 0.201027 tcp 10.0.2.16 49317 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:03.064595 0.171273 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.236468 0.092403 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 256 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.237000 2.998858 tcp 10.0.2.16 49318 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:31:03.329424 0.121427 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 661 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.435747 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:12.234538 0.000000 tcp 10.0.2.16 49318 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:31:20.957643 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:24.231866 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:29.238975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:34.245912 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:38.333865 0.166669 tcp 10.0.2.16 49319 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:38.500972 0.198486 tcp 10.0.2.16 49320 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:33:26.081156 2.999704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:33:33.087003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:41.088211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:57.091433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:34:29.097640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:40:33.105267 2.999599 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:40:40.110593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:40:48.112564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:04.115641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:36.121213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:40.128949 3.000177 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:47:47.134588 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:55.135900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:11.139422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:43.145610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:54:47.153134 3.000290 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:54:54.158810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:02.160470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:18.163056 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:50.169420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:01:54.176922 3.000036 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:02:01.183124 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:05.829481 0.000130 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:02:05.829806 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:09.184026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:21.231868 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:25.186950 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:37.927596 0.111754 tcp 10.0.2.16 49321 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:02:38.039738 0.148074 tcp 10.0.2.16 49322 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:02:38.189880 4.306794 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.272962 3.781185 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.273506 2.996982 tcp 10.0.2.16 49323 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:02:38.412633 3.877827 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1975 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.491089 0.139765 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 476 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:42.497301 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:47.269475 0.000000 tcp 10.0.2.16 49323 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:02:49.873656 0.143045 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 709 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:57.193610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:59.277952 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:03:04.283413 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:03:09.290944 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:09:01.200461 3.000833 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:09:08.206432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:17.529927 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:33.532759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:10:05.539092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:09.545945 3.001269 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:16:16.552491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:24.554144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:40.557450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:17:12.562893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:24.572414 3.000055 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:23:31.577921 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:39.579528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:55.582194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:24:27.588249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:30:54.599523 2.999655 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:31:01.605319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:09.606878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:25.609789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:57.615638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:33:00.736832 0.000158 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:33:00.737194 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:16.709688 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:33.665853 0.129783 tcp 10.0.2.16 49324 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:33:33.795789 0.150920 tcp 10.0.2.16 49325 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:33:33.947293 0.115086 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 787 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.040285 0.068056 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 324 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.040589 2.997903 tcp 10.0.2.16 49326 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:33:34.108690 0.140916 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 252 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.249953 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:43.047556 0.000000 tcp 10.0.2.16 49326 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:33:52.670922 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:55.054846 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:00.062168 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:05.068652 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:11.198726 0.111396 tcp 10.0.2.16 49327 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:34:11.309478 0.142836 tcp 10.0.2.16 49328 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:38:01.621094 3.002399 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 19:38:08.629148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:16.630798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:32.633536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:39:04.639361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:08.646717 3.000309 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:45:15.652855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:23.655426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:39.657144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:46:11.663634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:15.671111 3.000296 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:52:22.676616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:30.678609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:46.681216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:53:18.687987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:22.695418 2.999598 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:59:29.700827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:37.702438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:53.705490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:00:25.711750 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:04:34.289595 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:04:34.289947 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:04:52.435004 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:10.585730 0.167258 tcp 10.0.2.16 49329 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:05:10.753366 0.195826 tcp 10.0.2.16 49330 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:05:10.950457 4.649736 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1479 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.043161 3.768277 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1969 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.043880 3.002029 tcp 10.0.2.16 49331 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:05:11.148603 4.175293 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1755 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.321154 0.169310 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 582 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:15.600631 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:20.044482 0.000000 tcp 10.0.2.16 49331 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:05:21.657035 0.181254 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 575 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:32.042436 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:37.049668 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:42.056484 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:06:29.719326 2.999629 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 20:06:36.724890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:06:44.726315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:07:00.729475 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:07:32.735642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:36.743506 2.999810 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:13:43.748743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:51.750685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:14:07.753244 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:14:39.759578 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:43.766612 3.000855 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:20:50.772720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:58.774144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:21:14.777557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:21:46.783134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:27:50.791370 2.999336 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:27:57.796958 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:05.798684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:21.801280 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:53.807685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:34:57.814717 3.000411 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:35:04.820479 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:12.822014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:28.825097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:54.281990 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:35:54.282367 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:00.831052 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:36:12.388552 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:31.389623 0.165474 tcp 10.0.2.16 49332 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:36:31.555587 0.207867 tcp 10.0.2.16 49333 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:36:31.764403 0.167525 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:31.932571 0.092967 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 352 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:31.933131 2.997343 tcp 10.0.2.16 49334 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:36:32.026069 0.106707 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:32.131995 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:40.929068 0.000000 tcp 10.0.2.16 49334 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:36:48.539934 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:52.936690 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:57.943678 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:37:02.950671 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:37:05.296658 0.165404 tcp 10.0.2.16 49335 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:37:05.462572 0.200701 tcp 10.0.2.16 49336 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:42:04.838828 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 20:42:11.845004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:19.845855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:35.849524 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:43:07.855148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:11.863088 2.999893 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:49:18.868947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:26.869913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:42.873122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:50:14.879336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:18.886648 3.000288 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:56:25.892283 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:33.894148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:49.897218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:57:21.902825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:25.910638 3.000845 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:03:32.916968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:40.919412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:56.922467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:04:28.927217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:07:16.508294 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:07:16.508638 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:07:32.721598 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:07:51.252879 1.921157 tcp 10.0.2.16 49337 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:07:51.419399 0.202726 tcp 10.0.2.16 49338 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:07:51.622668 4.405090 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:51.724076 4.993702 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 5 1175 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:51.724665 2.998063 tcp 10.0.2.16 49339 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:07:51.894161 4.580014 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:52.001477 0.171067 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:56.914181 0.169259 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 3 543 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:57.083903 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:00.721948 0.000000 tcp 10.0.2.16 49339 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:08:02.855229 0.392553 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 613 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:08:12.718922 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:17.726388 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:22.733293 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:10:32.932518 3.002615 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 21:10:39.940762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:10:47.941776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:11:03.945268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:11:35.950870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:39.956923 3.001647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:17:46.964204 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:54.966204 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:18:10.968782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:18:42.974865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:24:46.980298 3.002634 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:24:53.988744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:01.989577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:17.993404 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:49.998710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:31:54.004306 3.002689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:32:01.012411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:09.013882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:25.017245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:57.023245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:38:26.666828 0.000141 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:38:26.667188 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:38:45.353605 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:01.028753 3.001594 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:39:01.860055 1.751553 tcp 10.0.2.16 49340 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:02.036732 0.200010 tcp 10.0.2.16 49341 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:02.237251 0.106343 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.342773 0.096878 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.343062 2.999666 tcp 10.0.2.16 49342 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:39:02.439975 0.169898 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 215 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.610219 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:08.036009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:11.341070 0.000000 tcp 10.0.2.16 49342 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:39:16.038259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:18.171368 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:23.338607 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:28.345628 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:32.041197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:33.353272 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:34.315567 1.864563 tcp 10.0.2.16 49343 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:34.480799 0.197204 tcp 10.0.2.16 49344 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:40:04.046809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:08.052383 3.002088 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:46:15.060642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:23.061790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:39.064809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:47:11.071026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:15.079074 2.999445 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:53:22.084513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:30.085808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:46.088471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:54:18.095103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:22.100151 3.002051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:00:29.108321 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:37.109711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:53.112708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:01:25.118961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:29.126836 2.999912 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:07:36.132536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:44.133587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:00.136600 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:32.142653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:09:40.571368 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:09:40.571710 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:09:58.216569 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:15.376177 1.921877 tcp 10.0.2.16 49345 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:10:15.542686 0.207565 tcp 10.0.2.16 49346 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:10:15.751219 4.651374 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1445 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:15.842824 3.769991 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2140 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:15.843654 3.002491 tcp 10.0.2.16 49347 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:10:15.949331 4.179416 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1462 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:16.122577 0.173887 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:20.403129 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:24.845266 0.000000 tcp 10.0.2.16 49347 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:10:26.107034 0.172950 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:36.842041 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:41.849582 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:46.856351 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:14:36.150329 2.999953 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:14:43.156515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:14:51.158149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:15:07.160490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:15:39.166743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:43.173914 3.000814 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:21:50.179890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:58.181523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:22:14.185531 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:22:46.190909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:28:50.196097 3.002433 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:28:57.204007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:05.205332 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:21.208385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:53.214641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:35:57.222365 2.999850 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:36:04.228309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:36:12.229295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:36:28.232701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:37:00.238726 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:40:53.604179 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:40:53.604501 0.106598 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:40:53.710399 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:40:53.711572 2.997086 tcp 10.0.2.16 49348 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:02.717395 0.000000 tcp 10.0.2.16 49348 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:12.371095 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:14.715551 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:19.721864 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:24.728824 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:29.480038 0.167093 tcp 10.0.2.16 49349 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:41:29.647628 0.200026 tcp 10.0.2.16 49350 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:41:29.848720 0.091254 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 249 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:41:29.940554 0.168408 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 404 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:41:29.941099 2.999460 tcp 10.0.2.16 49351 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:30.109497 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:38.939355 0.000000 tcp 10.0.2.16 49351 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:48.974210 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:50.946590 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:55.954040 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:42:00.961220 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:42:04.258124 0.166958 tcp 10.0.2.16 49352 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:42:04.425359 0.200686 tcp 10.0.2.16 49353 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:43:04.246306 2.999764 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:43:11.251800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:19.253777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:35.256753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:44:07.263009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:11.270257 2.999904 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:50:18.275800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:26.277695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:42.281040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:51:14.286773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:18.292019 3.002001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:57:25.300262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:33.301170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:49.304669 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:58:21.310170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:25.318245 3.000718 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:04:32.323709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:40.325851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:56.328230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:05:28.334255 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:32.341708 3.000785 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:11:39.348133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:47.349129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:03.352803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:23.231106 0.000185 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:12:23.231448 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:12:35.358527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:40.275762 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:12:58.727068 0.165131 tcp 10.0.2.16 49354 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:12:58.892762 0.197921 tcp 10.0.2.16 49355 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:12:59.091822 4.655716 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2088 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.196924 3.714997 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1566 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.197456 2.999241 tcp 10.0.2.16 49356 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:12:59.289807 4.139277 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.463660 0.170712 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 464 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:13:03.746620 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:08.195653 0.000000 tcp 10.0.2.16 49356 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:13:12.441997 0.172089 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:13:20.193415 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:25.200034 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:30.207674 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:18:39.365632 3.000449 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 23:18:46.371868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:18:54.373761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:19:10.376176 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:19:42.382631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:25:46.390321 2.999689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:25:53.395968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:01.397376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:17.400325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:49.406505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:32:53.414018 3.000452 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:33:00.420228 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:08.421077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:24.424915 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:56.430313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:00.437782 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:40:07.443766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:15.444968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:31.448049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:41:03.454104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:43:38.657784 0.000090 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:43:38.657956 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:43:54.570719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:10.678046 0.165559 tcp 10.0.2.16 49357 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:10.843976 0.204143 tcp 10.0.2.16 49358 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:11.049128 0.169319 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.219201 0.106926 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.219835 2.998617 tcp 10.0.2.16 49359 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:44:11.325057 0.092215 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 286 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.417857 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:20.227289 0.000000 tcp 10.0.2.16 49359 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:44:26.596785 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:32.224714 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:37.231685 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:42.238853 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:44.293909 0.165627 tcp 10.0.2.16 49360 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:44.460085 0.205185 tcp 10.0.2.16 49361 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:47:07.461692 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 23:47:14.467559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:22.469170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:38.472764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:48:10.478233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:14.485983 3.000184 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:54:21.491710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:29.492975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:45.496076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:55:17.502484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:21.509635 3.000281 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:01:28.516249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:36.517173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:52.520427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:02:24.526314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:28.534128 2.999945 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:08:35.539576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:43.541516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:59.544122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:09:31.550003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:03.888332 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:15:03.888636 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:19.060016 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:35.557701 3.000208 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:15:36.860298 0.172538 tcp 10.0.2.16 49362 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:15:37.033111 0.200273 tcp 10.0.2.16 49363 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:15:37.233940 4.752895 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2086 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.446654 3.946644 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.447329 2.992963 tcp 10.0.2.16 49364 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:15:37.617345 4.051943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1463 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.710302 0.171132 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:41.986314 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:42.563551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:46.439045 0.000000 tcp 10.0.2.16 49364 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:15:50.564919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:50.785765 0.172356 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:58.446658 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:03.453963 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:06.567992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:16:08.461061 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:38.574390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:42.581903 3.000917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:22:49.588576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:57.588759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:23:13.591884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:23:45.598019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:29:49.605819 2.999686 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:29:56.611711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:04.613034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:20.615779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:52.621794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:36:56.629346 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:37:03.635325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:11.636769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:27.640094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:59.646636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:03.653202 3.000655 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:44:10.659484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:18.660779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:34.663690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:45:06.670146 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:46:06.225968 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:46:06.226272 0.171911 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 257 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:06.398805 0.091114 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 267 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:06.399732 3.000440 tcp 10.0.2.16 49365 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:46:06.490455 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:15.399394 0.000000 tcp 10.0.2.16 49365 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:46:23.370187 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:27.406141 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:32.413788 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:37.420965 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:41.470716 0.165363 tcp 10.0.2.16 49366 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:46:41.636589 0.197155 tcp 10.0.2.16 49367 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:46:41.834635 0.108291 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 467 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:41.942036 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:59.542263 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:47:16.519140 0.165853 tcp 10.0.2.16 49368 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:47:16.685446 0.202341 tcp 10.0.2.16 49369 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:51:10.677310 3.000216 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 00:51:17.683722 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:25.684785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:41.688159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:52:13.693935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:17.701219 3.000108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:58:24.707363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:32.708783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:48.712041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:59:20.718368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:24.725829 2.999633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:05:31.731498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:39.732892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:55.735918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:06:27.741972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:31.749487 3.000180 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:12:38.755313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:46.757053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:13:02.759873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:13:34.766254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:17:42.462595 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:17:42.462949 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:17:59.176043 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:16.205925 0.167586 tcp 10.0.2.16 49370 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:18:16.374023 0.201475 tcp 10.0.2.16 49371 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:18:16.576442 4.653258 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.753017 3.649276 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1865 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.753596 3.002086 tcp 10.0.2.16 49372 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:18:16.845992 3.879528 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1756 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.951857 0.171912 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:21.230237 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:25.754547 0.000000 tcp 10.0.2.16 49372 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:18:29.990586 0.170177 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:37.751587 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:42.759456 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:47.765870 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:19:38.773262 3.000726 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 01:19:45.779020 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:19:53.781187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:20:09.783913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:20:41.789685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:26:45.797929 2.999943 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:26:52.803519 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:00.804441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:16.808165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:48.813558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:33:52.820853 3.000729 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:33:59.827118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:07.828870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:23.831665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:55.838116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:40:59.845634 2.999468 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:41:06.851656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:14.852457 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:30.855999 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:42:02.861722 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:06.869414 2.999756 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:48:13.874964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:21.876771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:37.880065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:49:00.112207 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:49:00.112515 0.095879 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 246 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:00.209022 0.106586 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:00.209727 3.006060 tcp 10.0.2.16 49373 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:00.314824 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:09.214992 0.000000 tcp 10.0.2.16 49373 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:09.885917 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:49:19.239721 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:21.212672 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:26.219451 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:31.226785 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:38.170714 0.166099 tcp 10.0.2.16 49374 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:49:38.337316 0.199459 tcp 10.0.2.16 49375 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:49:38.537762 0.167908 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:38.706297 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:38.706932 2.994182 tcp 10.0.2.16 49376 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:47.699698 0.000000 tcp 10.0.2.16 49376 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:56.362963 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:59.707572 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:04.714397 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:09.721973 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:14.350709 0.167074 tcp 10.0.2.16 49377 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:50:14.518056 0.203573 tcp 10.0.2.16 49378 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:55:13.892944 3.000168 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 01:55:20.899431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:28.900970 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:44.903986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:56:16.909712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:20.917012 3.000956 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:02:27.924358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:35.924263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:51.927522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:03:23.933411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:27.941217 3.000332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:09:34.947139 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:42.948488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:58.951922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:10:30.958030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:34.965088 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:16:41.971019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:49.972335 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:17:05.975725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:17:37.981565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:20:39.613186 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:20:39.613535 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:20:57.789434 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:15.348655 0.167287 tcp 10.0.2.16 49379 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:21:15.516419 0.198182 tcp 10.0.2.16 49380 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:21:15.715679 4.677854 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1575 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:15.812558 3.774173 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2028 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:15.813098 2.996559 tcp 10.0.2.16 49381 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:21:15.918477 4.185689 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1407 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:16.092197 0.168846 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 476 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:20.394082 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:24.818050 0.000000 tcp 10.0.2.16 49381 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:21:26.540593 0.170841 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:36.825256 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:41.832372 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:46.839620 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:23:41.988940 2.999978 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 02:23:48.994723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:23:56.996279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:24:12.999687 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:24:45.005389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:30:49.013069 3.000268 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:30:56.018871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:04.020643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:20.023797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:52.029771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:37:56.037567 2.999370 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:38:03.042840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:11.044756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:27.047411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:59.053667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:03.060800 3.000012 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:45:10.066569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:18.068145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:34.071081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:46:06.077992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:51:36.713777 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:51:36.714085 0.111322 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 416 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:51:36.824883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:51:36.826022 3.000960 tcp 10.0.2.16 49382 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:51:45.825595 0.000000 tcp 10.0.2.16 49382 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:51:55.640462 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:51:57.823216 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:02.830702 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:07.837444 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:10.084892 3.000440 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 02:52:12.509300 0.171213 tcp 10.0.2.16 49383 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:12.680892 0.200650 tcp 10.0.2.16 49384 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:12.882451 0.091608 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:52:12.974656 0.167996 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 319 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:52:12.975458 2.994109 tcp 10.0.2.16 49385 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:52:13.143378 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:17.091053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:21.977543 0.000000 tcp 10.0.2.16 49385 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:52:25.092155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:28.517754 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:33.985937 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:38.992636 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:41.095751 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:43.999632 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:47.226122 0.216884 tcp 10.0.2.16 49386 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:47.443440 0.249182 tcp 10.0.2.16 49387 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:53:13.101103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:17.108858 3.000329 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:59:24.115710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:32.116748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:48.120118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:00:20.125295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:24.132471 3.000257 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:06:31.138878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:39.140024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:55.143443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:07:27.149232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:31.156965 3.000082 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:13:38.162804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:46.164481 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:02.166982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:34.173043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:38.180899 3.000073 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:20:45.186480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:53.188512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:21:09.191346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:21:41.197035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:23:01.693630 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:23:01.693963 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:20.610552 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:38.460266 0.250073 tcp 10.0.2.16 49388 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:23:38.710770 0.235179 tcp 10.0.2.16 49389 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:23:38.946932 4.760435 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2244 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.058780 3.769250 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1681 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.059815 3.000895 tcp 10.0.2.16 49390 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:23:39.161703 4.211429 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.343800 0.173885 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:43.706334 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:48.059637 0.000000 tcp 10.0.2.16 49390 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:23:52.175571 0.180244 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:24:00.067718 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:24:05.074447 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:24:10.081847 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:27:45.204906 2.999667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 03:27:52.210894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:00.212458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:16.215107 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:48.221214 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:34:52.228422 3.000609 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:34:59.234512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:07.236608 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:23.239604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:55.245696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:41:59.252969 3.000174 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:42:06.258526 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:14.260257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:30.262818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:43:02.268929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:06.276910 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:49:13.282577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:21.283833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:37.287048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:50:09.293117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:54:21.245705 0.000136 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:54:21.246009 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:54:37.388920 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:54:55.860148 0.178530 tcp 10.0.2.16 49391 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:54:56.039102 0.220594 tcp 10.0.2.16 49392 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:54:56.260746 0.172632 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 290 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.433937 0.112011 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 496 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.434550 2.985844 tcp 10.0.2.16 49393 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:54:56.546325 0.097863 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.644729 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:05.418666 0.000000 tcp 10.0.2.16 49393 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:55:14.371694 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:17.426090 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:22.433270 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:27.440864 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:30.887982 1.895032 tcp 10.0.2.16 49394 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:55:31.066444 0.214491 tcp 10.0.2.16 49395 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:56:13.300830 3.000343 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 03:56:20.306244 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:28.308062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:44.311222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:57:16.316836 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:20.324340 3.000318 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:03:27.330955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:35.332405 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:51.335360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:04:23.341075 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:27.348689 3.000042 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:10:34.354586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:42.355889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:58.358984 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:11:30.365181 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:34.372798 3.000036 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:17:41.378311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:49.380008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:18:05.382837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:18:37.389282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:41.396528 3.000249 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:24:48.402530 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:56.403914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:12.406776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:44.413268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:48.318651 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:25:48.318993 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:05.163013 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:20.769744 0.198421 tcp 10.0.2.16 49396 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:26:20.968508 0.238589 tcp 10.0.2.16 49397 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:26:21.208217 4.884198 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2426 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.339712 4.039729 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.340255 3.000186 tcp 10.0.2.16 49398 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:26:21.526149 4.174952 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1512 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.634390 0.184076 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:26.091916 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:30.339082 0.000000 tcp 10.0.2.16 49398 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:26:32.642870 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:37.809735 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:42.346940 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:44.780138 0.183423 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 422 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:47.353880 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:47.964554 0.554489 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:48.519793 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:52.361071 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:56.877152 0.184874 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 487 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.062072 0.378336 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1801 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.439953 0.314127 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1288 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.440958 3.005261 tcp 10.0.2.16 49399 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:27:00.754620 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:04.598185 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:27:09.274860 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:09.444807 0.000000 tcp 10.0.2.16 49399 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:27:18.198124 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:21.442417 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:26.449768 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:26.479870 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:31.457222 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:34.040617 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:41.812225 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:46.598374 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:27:48.731931 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:55.100865 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:01.109650 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:07.949580 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:15.660894 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:22.121320 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:31:48.420309 3.000078 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 04:31:55.426671 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:03.428064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:19.431147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:51.436961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:38:55.444191 3.000707 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:39:02.450043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:10.452283 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:26.454694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:58.461292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:02.468772 3.000052 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:46:09.474677 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:17.475898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:33.479101 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:47:05.484563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:09.492469 3.000387 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:53:16.498358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:24.499830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:40.503050 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:54:12.508906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:58:59.752307 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:58:59.752620 0.178030 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:58:59.931071 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:58:59.931981 3.004368 tcp 10.0.2.16 49400 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:59:08.935158 0.000000 tcp 10.0.2.16 49400 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:59:15.664861 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:20.933107 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:25.939556 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:30.947391 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:32.763899 0.203392 tcp 10.0.2.16 49401 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:59:32.967729 0.224396 tcp 10.0.2.16 49402 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:59:33.193051 0.138216 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:59:33.330250 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:52.037266 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:10.045358 0.202082 tcp 10.0.2.16 49403 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:00:10.247951 0.207431 tcp 10.0.2.16 49404 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:00:10.456322 0.101863 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:00:10.559104 2.989180 tcp 10.0.2.16 49405 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:00:16.516492 3.000121 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:00:19.556774 0.000000 tcp 10.0.2.16 49405 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:00:23.522411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:31.523653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:31.553983 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:36.561178 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:41.568756 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:47.526904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:01:19.532882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:23.540597 2.999599 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:07:30.546462 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:38.547794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:54.550803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:08:26.556478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:30.564593 2.999807 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:14:37.570051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:45.571413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:15:01.574949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:15:33.580747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:37.588146 3.000374 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:21:44.593846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:52.595388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:22:08.598974 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:22:40.604762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:44.612212 3.000162 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:28:51.618221 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:59.619791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:29:15.622617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:29:47.628911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:30:31.241816 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:30:31.242159 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:30:47.635030 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:03.422005 0.179280 tcp 10.0.2.16 49406 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:03.601689 0.236809 tcp 10.0.2.16 49407 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:03.839607 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:20.582156 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:36.417453 0.202863 tcp 10.0.2.16 49408 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:36.620154 0.252063 tcp 10.0.2.16 49409 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:36.873140 0.178703 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.052492 0.126154 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.053042 2.997668 tcp 10.0.2.16 49410 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:31:37.177773 0.097016 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.275743 0.180303 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 627 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:40.451565 0.171462 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 606 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:43.625578 0.360295 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1265 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:43.985511 0.292446 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:44.278458 0.538260 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1357 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:44.817208 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:46.048877 0.000000 tcp 10.0.2.16 49410 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:31:49.934914 0.174416 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:58.056579 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:32:03.063895 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:32:08.070521 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:35:51.636304 2.999697 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:35:58.642004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:06.643453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:22.646640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:54.652298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:42:58.660489 2.999722 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:43:05.666305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:13.667365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:29.670421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:44:01.676451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:05.683938 3.000465 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:50:12.689945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:20.692003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:36.694249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:51:08.700338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:12.708173 2.999903 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:57:19.713645 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:27.715667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:43.718843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:58:15.724891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:01:58.394956 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:01:58.395499 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:17.101452 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:32.738880 2.462554 tcp 10.0.2.16 49411 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:02:33.394674 0.804652 tcp 10.0.2.16 49412 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:02:34.200279 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:50.649719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:08.117897 0.467574 tcp 10.0.2.16 49413 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:08.585718 0.541342 tcp 10.0.2.16 49414 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:09.128004 0.298369 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 399 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:09.427079 0.271547 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 653 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:09.427655 2.993105 tcp 10.0.2.16 49415 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:03:09.697995 0.323673 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:10.022177 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:18.419342 0.000000 tcp 10.0.2.16 49415 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:03:28.874620 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:30.426940 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:35.434831 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:40.441344 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:46.452404 0.671179 tcp 10.0.2.16 49416 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:47.123946 0.811502 tcp 10.0.2.16 49417 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:04:19.732510 2.999826 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 06:04:26.737601 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:34.739368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:50.742259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:05:22.748189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:26.756151 3.000083 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:11:33.762180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:41.763569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:57.766196 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:12:29.772310 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:33.780447 2.999941 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:18:40.785982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:48.787759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:19:04.790753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:19:36.796704 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:40.803853 3.000434 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:25:47.809896 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:55.811725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:26:11.814276 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:26:43.820475 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:32:47.827923 3.000279 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:32:54.833710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:02.835455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:18.838484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:50.844714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:34:10.573071 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:34:10.573437 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:29.150004 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:46.619407 0.597050 tcp 10.0.2.16 49418 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:34:47.216915 0.644904 tcp 10.0.2.16 49419 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:34:47.862808 0.313400 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:48.176858 4.731937 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2084 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:48.177416 2.993652 tcp 10.0.2.16 49420 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:34:48.636605 4.927707 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1325 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:49.176986 0.398499 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 634 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:52.907879 0.297986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1151 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:53.740931 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:53.741466 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:57.169305 0.000000 tcp 10.0.2.16 49420 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:34:59.052656 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:05.942678 0.221204 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:09.167669 0.586154 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1143 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:09.177463 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:09.754376 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:14.184340 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:17.930138 0.221821 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:19.191995 2.589430 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1608 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:21.154558 0.335622 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1493 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:21.781994 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:28.214627 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:33.101655 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:35:34.964183 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:42.925364 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:48.483858 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:55.443994 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:02.794592 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:08.793790 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:14.000344 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:18.606775 0.000197 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:36:22.171801 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:30.794424 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:36.502872 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:39:54.851459 3.000710 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 06:40:01.857781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:09.859433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:25.862615 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:57.868442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:01.875638 3.000291 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:47:08.882093 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:16.883384 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:32.886236 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:48:04.892467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:08.899779 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:54:15.906045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:23.907498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:39.910359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:55:11.917592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:15.924892 2.998703 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:01:22.929850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:30.930911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:46.934209 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:02:18.940069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:07:10.609938 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:07:10.610254 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:25.661335 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:43.010416 0.551124 tcp 10.0.2.16 49421 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:07:43.561791 0.849383 tcp 10.0.2.16 49422 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:07:44.412210 0.333658 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 309 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:07:44.746486 0.112408 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 545 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:07:44.747043 2.995865 tcp 10.0.2.16 49423 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:07:44.857964 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:53.741849 0.000000 tcp 10.0.2.16 49423 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:08:03.516179 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:05.739099 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:10.746581 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:15.753157 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:19.540939 0.203576 tcp 10.0.2.16 49424 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:08:19.745023 0.232427 tcp 10.0.2.16 49425 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:08:19.978334 0.102099 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 248 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:08:22.947967 2.999768 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:08:29.953279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:37.954829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:53.958410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:09:25.963847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:29.971670 3.000545 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:15:36.977761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:44.978755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:16:00.981800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:16:32.987847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:36.995439 3.000027 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:22:44.001690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:52.002922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:23:08.005981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:23:40.011790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:44.019518 3.000234 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:29:51.025311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:59.027355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:30:15.029698 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:30:47.036175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:36:51.043645 3.000233 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:36:58.049502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:06.051479 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:22.054269 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:54.059894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:38:43.902006 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:38:43.902325 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:38:58.923618 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:14.150075 0.537604 tcp 10.0.2.16 49426 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:14.688139 0.548177 tcp 10.0.2.16 49427 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:15.237542 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:31.459919 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:47.825819 0.508386 tcp 10.0.2.16 49428 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:48.334801 0.485300 tcp 10.0.2.16 49429 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:48.821065 0.419193 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.240885 0.258869 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.241481 2.998752 tcp 10.0.2.16 49430 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:39:49.499402 0.274194 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.774279 0.384812 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 478 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:53.161534 0.327173 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 498 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:56.486184 0.333593 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:56.819469 0.803783 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:57.623796 0.295731 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1330 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:57.920060 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:58.238431 0.000000 tcp 10.0.2.16 49430 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:40:04.978694 0.333320 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:40:10.246234 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:40:15.253540 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:40:20.260697 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:43:58.067268 3.000146 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:44:05.073327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:13.075083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:29.077942 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:45:01.084294 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:05.091588 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:51:12.097797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:20.098810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:36.101597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:52:08.107741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:12.116000 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:58:19.121605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:27.122551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:43.125560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:59:15.131797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:19.139537 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:05:26.145702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:34.147072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:50.149772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:06:22.156291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:10:31.524559 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:10:31.524925 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:10:48.689174 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:07.681232 0.228445 tcp 10.0.2.16 49431 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:07.910077 0.212883 tcp 10.0.2.16 49432 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:08.123916 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:26.293411 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:44.230930 0.178545 tcp 10.0.2.16 49433 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:44.409990 0.211465 tcp 10.0.2.16 49434 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:44.622343 0.270457 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:44.893395 0.112353 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:44.893950 2.999880 tcp 10.0.2.16 49435 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:11:45.004596 0.096929 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:45.102067 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:53.893082 0.000000 tcp 10.0.2.16 49435 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:12:00.762851 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:05.890561 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:10.897534 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:15.904706 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:19.492145 0.202019 tcp 10.0.2.16 49436 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:12:19.694681 0.229747 tcp 10.0.2.16 49437 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:12:26.163377 3.000057 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:12:33.169350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:41.170660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:57.173634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:13:29.179684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:33.187527 2.999758 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:19:40.192987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:48.194981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:20:04.197665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:20:36.203741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:40.211356 3.000041 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:26:47.217320 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:55.218914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:27:11.221815 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:27:43.227906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:33:47.235446 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:33:54.240852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:02.242378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:18.245901 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:50.251880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:40:54.259119 3.000385 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:41:01.265175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:09.267041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:25.269794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:57.275712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:42:23.323660 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:42:23.324002 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:42:40.167818 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:42:57.697839 0.177915 tcp 10.0.2.16 49438 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:42:57.876044 0.213548 tcp 10.0.2.16 49439 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:42:58.090482 4.993203 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1113 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.201956 4.478223 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.202486 2.995204 tcp 10.0.2.16 49440 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:42:58.476829 4.496255 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.574961 0.280565 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:03.195761 0.111637 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 909 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:03.306857 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:07.195942 0.000000 tcp 10.0.2.16 49440 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:43:08.718592 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:16.930763 0.273100 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:19.193772 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:20.205366 0.820389 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:21.026427 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:24.200980 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:26.263655 0.276728 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 692 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:29.207872 0.664654 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1870 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:29.871796 0.293937 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1247 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:30.166308 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:38.331788 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:43.098345 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:43:46.262473 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:52.391330 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:58.289992 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:04.318774 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:11.999372 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:19.510323 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:26.109814 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:31.096622 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:44:33.019818 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:40.831506 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:45.857961 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:48:01.283390 3.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:48:08.288805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:16.290548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:32.294007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:49:04.300086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:08.306820 3.000702 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:55:15.312777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:23.314447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:39.317546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:56:11.323884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:15.331157 3.000304 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:02:22.337083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:30.338757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:46.341759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:03:18.347420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:22.354791 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:09:29.360736 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:37.362617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:53.365512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:10:25.371661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:14:57.062196 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:14:57.062536 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:15.378838 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:31.045489 0.199279 tcp 10.0.2.16 49441 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:15:31.245024 0.213055 tcp 10.0.2.16 49442 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:15:31.459021 0.280833 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:15:31.740459 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:31.741030 3.004960 tcp 10.0.2.16 49443 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:15:40.745462 0.000000 tcp 10.0.2.16 49443 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:15:48.436523 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:52.742543 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:57.750091 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:16:02.756577 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:16:07.084875 0.177837 tcp 10.0.2.16 49444 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:16:07.263033 0.209425 tcp 10.0.2.16 49445 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:16:07.473433 0.097988 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 278 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:16:07.571950 0.111898 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:16:29.378752 3.000906 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:16:36.384643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:16:44.386886 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:17:00.389476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:17:32.395343 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:36.403097 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:23:43.408949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:51.410521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:24:07.413145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:24:39.419843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:43.427378 2.999511 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:30:50.432878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:58.434712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:31:14.437560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:31:46.443635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:37:50.451580 2.999820 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:37:57.456659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:05.458686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:21.461945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:53.467930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:44:57.474998 3.000390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:45:04.480983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:12.482548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:28.485873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:46:00.491632 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:46:25.208395 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:46:25.208733 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:46:41.240385 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:46:57.367814 0.177976 tcp 10.0.2.16 49446 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:46:57.546061 0.212340 tcp 10.0.2.16 49447 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:46:57.759538 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:13.135705 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:29.531165 0.178193 tcp 10.0.2.16 49448 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:47:29.709197 0.209784 tcp 10.0.2.16 49449 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:47:29.920067 0.273784 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.194438 0.113054 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.195062 2.999940 tcp 10.0.2.16 49450 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:47:30.306308 0.096986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.403958 0.279865 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 710 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:33.685863 0.270588 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 445 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:36.959953 0.334494 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:37.294104 0.290239 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1393 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:37.584857 0.833038 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:38.418385 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:39.193206 0.000000 tcp 10.0.2.16 49450 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:47:43.650140 0.270717 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 581 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:51.190785 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:56.198062 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:48:01.205264 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:52:04.498594 3.000501 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:52:11.504562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:19.506636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:35.509569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:53:07.515557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:11.522473 3.000322 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:59:18.528666 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:26.530130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:42.533163 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:00:14.539120 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:18.547119 3.000033 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:06:25.552864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:33.554232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:49.557365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:07:21.563380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:25.570428 3.000421 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:13:32.576357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:40.578801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:56.581783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:14:28.587456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:18:03.606560 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:18:03.606851 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:22.173325 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:41.075121 0.178054 tcp 10.0.2.16 49451 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:18:41.252994 0.212187 tcp 10.0.2.16 49452 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:18:41.466147 0.112210 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 630 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:18:41.577650 0.097615 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:18:41.578773 3.006981 tcp 10.0.2.16 49453 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:18:41.675786 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:50.583873 0.000000 tcp 10.0.2.16 49453 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:18:57.493742 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:02.581449 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:07.588284 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:12.595853 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:14.760789 0.178573 tcp 10.0.2.16 49454 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:14.939798 0.209304 tcp 10.0.2.16 49455 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:15.150073 0.266303 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 330 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:19:15.416914 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:33.785976 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:52.565846 0.178027 tcp 10.0.2.16 49456 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:52.744211 0.206503 tcp 10.0.2.16 49457 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:20:32.594685 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:20:39.600960 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:20:47.602264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:21:03.605285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:21:35.611402 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:39.618626 3.000192 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:27:46.624855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:54.626268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:28:10.629051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:28:42.634902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:34:46.643137 2.999385 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:34:53.648646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:01.649953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:17.653119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:49.659049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:41:53.666777 2.999848 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:42:00.672940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:08.674043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:24.677403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:56.683621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:00.690693 3.000445 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:49:07.696467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:15.697801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:31.701200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:50:03.497372 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:50:03.497664 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:03.706782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:50:22.053942 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:40.694903 0.179183 tcp 10.0.2.16 49458 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:50:40.874613 0.208988 tcp 10.0.2.16 49459 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:50:41.084527 4.751286 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.196539 3.766695 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.197530 3.007695 tcp 10.0.2.16 49460 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:50:41.296835 4.203173 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.487913 0.178154 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 528 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:45.835360 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:50.203570 0.000000 tcp 10.0.2.16 49460 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:50:52.587772 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:59.837813 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:02.201439 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:06.317895 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:07.208763 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:12.215630 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:14.479161 0.175374 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 447 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:17.653661 0.538909 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1095 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:18.193290 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:18.193842 2.994650 tcp 10.0.2.16 49461 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:51:22.600782 0.000154 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:51:26.957081 0.173971 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 543 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:27.197065 0.000000 tcp 10.0.2.16 49461 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:51:30.131435 0.334744 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:30.465850 0.291267 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:30.757720 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:38.574026 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:39.194904 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:43.821215 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:44.201581 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:48.918914 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:49.209403 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:55.407713 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:03.529751 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:08.096128 0.000112 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:52:09.809104 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:15.436422 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:22.166464 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:30.528442 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:38.229197 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:45.510168 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:50.096035 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:56:07.714329 3.000310 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:56:14.720159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:22.721834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:38.724720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:57:10.730932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:14.738167 3.000799 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:03:21.744681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:29.745916 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:45.748855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:04:17.755092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:21.762577 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:10:28.768627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:36.769763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:52.772669 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:11:24.778732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:28.786714 3.000088 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:17:35.792467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:43.794301 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:59.796777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:18:31.802619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:23:11.085077 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:23:11.085375 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:29.111357 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:46.399842 1.739186 tcp 10.0.2.16 49462 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:23:46.577723 0.205426 tcp 10.0.2.16 49463 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:23:46.784195 0.173658 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 323 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:23:46.958464 0.114079 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 691 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:23:46.959050 3.001724 tcp 10.0.2.16 49464 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:23:47.071736 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:55.959440 0.000000 tcp 10.0.2.16 49464 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:24:04.531197 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:07.966741 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:12.974057 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:17.980997 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:22.439594 0.179197 tcp 10.0.2.16 49465 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:24:22.619315 0.212582 tcp 10.0.2.16 49466 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:24:22.832837 0.096739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:24:35.811030 2.999237 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 11:24:42.816351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:24:50.817765 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:25:06.821275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:25:38.827226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:42.834566 3.000172 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:31:49.840621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:57.841489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:32:13.844863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:32:45.850822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:38:49.858291 3.000623 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:38:56.864487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:04.865525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:20.868961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:52.874977 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:45:56.882398 3.000423 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:46:03.888087 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:11.890080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:27.892782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:59.898654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:03.906145 3.000601 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:53:10.913599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:18.914779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:34.918034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:54:06.923069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:54:39.319782 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:54:39.320098 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:54:57.796525 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:13.993913 0.176829 tcp 10.0.2.16 49467 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:14.171234 0.217071 tcp 10.0.2.16 49468 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:14.389239 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:30.864023 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:48.080315 0.178482 tcp 10.0.2.16 49469 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:48.259077 0.209770 tcp 10.0.2.16 49470 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:48.469853 0.244620 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.715060 0.112098 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.715674 2.997592 tcp 10.0.2.16 49471 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:55:48.826308 0.098292 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.925274 0.270666 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:52.194125 0.263058 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 437 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:55.458702 0.773090 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.232364 0.294768 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.527670 0.333201 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.860299 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 312 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:57.711824 0.000000 tcp 10.0.2.16 49471 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:56:04.832185 0.266506 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 530 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:56:09.709939 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:56:14.716524 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:56:19.724113 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:00:10.930569 3.000175 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:00:17.936370 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:25.937928 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:41.940786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:01:13.946747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:17.954517 3.000140 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:07:24.960165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:32.961451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:48.964477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:08:20.971290 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:24.978801 3.000704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:14:31.985041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:39.985707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:55.988769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:15:27.994339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:32.002012 3.000551 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:21:39.007782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:47.009470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:22:03.012667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:22:35.018625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:26:22.636462 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:26:22.636758 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:26:38.649086 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 137 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:26:54.455936 0.177784 tcp 10.0.2.16 49472 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:26:54.634120 0.210304 tcp 10.0.2.16 49473 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:26:54.845343 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:10.265060 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:28.663454 0.179576 tcp 10.0.2.16 49474 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:27:28.843391 0.210591 tcp 10.0.2.16 49475 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:27:29.054885 0.098113 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.153603 0.188361 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.154143 3.001761 tcp 10.0.2.16 49476 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:27:29.342474 0.113383 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.454701 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:38.154294 0.000000 tcp 10.0.2.16 49476 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:27:45.465272 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:50.152547 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:55.159622 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:28:00.166002 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:28:02.181450 0.178814 tcp 10.0.2.16 49477 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:28:02.360780 0.204536 tcp 10.0.2.16 49478 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:28:39.025876 3.000238 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:28:46.032014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:28:54.033940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:29:10.037035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:29:42.043057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:35:46.049864 3.000550 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:35:53.055947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:01.057804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:17.060474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:49.066903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:42:53.074466 2.999413 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:43:00.080058 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:08.081433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:24.084729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:56.090858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:00.097697 3.000776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:50:07.103904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:15.105164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:31.108895 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:51:03.115143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:07.122880 2.999633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:57:14.128258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:22.129112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:38.132823 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:58:10.138142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:58:31.529968 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:58:31.530283 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:58:46.921930 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:04.961593 0.178312 tcp 10.0.2.16 49479 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:59:05.139726 0.210979 tcp 10.0.2.16 49480 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:59:05.351668 4.715908 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.528247 3.676170 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1386 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.528784 3.003837 tcp 10.0.2.16 49481 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:59:05.625302 3.913843 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1934 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.736872 0.173641 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:10.068076 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:14.530733 0.000000 tcp 10.0.2.16 49481 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:59:16.894917 0.175968 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 512 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:26.538622 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:31.545942 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:36.552929 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:04:14.145699 3.000153 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:04:21.152048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:29.153629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:45.156464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:05:17.162776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:21.169888 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:11:28.175549 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:36.177010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:52.180540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:12:24.186535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:28.194166 2.999773 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:18:35.199566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:43.201144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:59.204345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:19:31.210519 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:35.218204 2.999667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:25:42.223506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:50.225712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:26:06.228427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:26:38.234560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:29:41.418532 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:29:41.418876 0.097699 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 352 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:29:41.517192 0.112999 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:29:41.517876 2.994394 tcp 10.0.2.16 49482 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 13:29:41.629021 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:29:50.510890 0.000000 tcp 10.0.2.16 49482 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 13:29:57.450769 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:02.518363 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:07.525274 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:12.533011 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:15.550912 0.178748 tcp 10.0.2.16 49483 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:15.730003 0.205963 tcp 10.0.2.16 49484 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:15.936883 0.173546 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 360 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:30:16.110973 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:32.802009 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:50.349515 0.177063 tcp 10.0.2.16 49485 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:50.527106 0.206115 tcp 10.0.2.16 49486 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:32:42.241425 3.000813 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:32:49.247710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:32:57.249366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:33:13.252327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:33:45.258741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:39:49.266360 3.000146 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:39:56.272074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:04.273665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:20.276471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:52.282024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:46:56.289862 2.999776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:47:03.295790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:11.297235 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:27.300302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:59.306360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:03.313852 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:54:10.319353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:18.321123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:34.324086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:55:06.330075 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:10.053718 0.000185 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:01:10.054082 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:10.338113 3.000272 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:01:17.343949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:25.344789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:26.036055 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:41.347881 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:42.023528 0.178406 tcp 10.0.2.16 49487 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:01:42.202331 0.209383 tcp 10.0.2.16 49488 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:01:42.412648 4.210943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1458 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.514837 3.804659 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.515413 2.998938 tcp 10.0.2.16 49489 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:01:42.636978 4.517362 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1695 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.814634 0.173149 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:47.154858 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:51.512422 0.000000 tcp 10.0.2.16 49489 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:01:54.957645 0.178315 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:02:03.510316 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:02:08.517401 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:02:13.354564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:02:13.524277 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:08:17.361349 3.000552 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:08:24.367959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:32.369278 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:48.372059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:09:20.378412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:24.385309 3.000546 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:15:31.391349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:39.393104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:55.396572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:16:27.402162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:31.409419 2.999986 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:22:38.416053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:46.416727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:23:02.420122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:23:34.425791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:38.433525 3.000002 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:29:45.439189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:53.441120 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:30:09.443691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:30:41.449691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:32:05.421055 0.000180 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:32:05.421397 0.112579 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 488 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:05.533475 0.097654 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 310 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:05.534651 3.000303 tcp 10.0.2.16 49490 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:32:05.631788 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:14.534142 0.000000 tcp 10.0.2.16 49490 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:32:21.684199 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:26.531512 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:31.538727 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:36.545760 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:38.923346 2.074809 tcp 10.0.2.16 49491 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:32:39.101998 0.214718 tcp 10.0.2.16 49492 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:32:39.317621 0.177913 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 241 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:39.496066 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:58.347110 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:33:14.001843 0.177749 tcp 10.0.2.16 49493 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:33:14.180080 0.207223 tcp 10.0.2.16 49494 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:36:45.457509 3.000050 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 14:36:52.463559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:00.464676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:16.468215 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:48.474166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:43:52.481209 3.000691 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:43:59.487460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:07.489059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:23.491868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:55.498147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:50:59.505818 3.000095 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:51:06.511145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:14.513121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:30.515783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:52:02.521863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:06.529115 3.000660 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:58:13.535357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:21.537227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:37.540166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:59:09.546055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:03:17.502599 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:03:17.502922 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:34.356522 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:49.573535 0.178721 tcp 10.0.2.16 49495 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:03:49.752515 0.207930 tcp 10.0.2.16 49496 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:03:49.961393 4.762511 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2032 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.072936 3.767430 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1623 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.074009 2.999804 tcp 10.0.2.16 49497 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:03:50.175753 4.214352 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1495 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.359344 0.178894 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:54.723433 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:59.071768 0.000000 tcp 10.0.2.16 49497 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:03:59.773031 0.177598 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:04:11.069776 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:04:16.076905 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:04:21.083954 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:05:13.553302 3.000102 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 15:05:20.559683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:28.561121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:44.564168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:06:16.569759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:20.577203 3.000450 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:12:27.583383 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:35.584905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:51.587833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:13:23.593482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:27.600825 3.000974 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:19:34.606931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:42.608445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:58.611566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:20:30.618115 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:34.625577 3.000380 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:26:41.630851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:49.632834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:05.635945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:37.642271 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:41.648806 3.000667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:33:48.654919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:56.656699 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:12.659681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:12.960316 0.000158 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:34:12.960623 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:28.503031 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:44.509952 0.176777 tcp 10.0.2.16 49498 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:34:44.665793 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:44.687106 0.207891 tcp 10.0.2.16 49499 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:34:44.896164 0.172564 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.069335 0.111971 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 522 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.069893 3.000500 tcp 10.0.2.16 49500 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:34:45.180537 0.099035 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 283 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.280096 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:54.068987 0.000000 tcp 10.0.2.16 49500 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:35:03.052188 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:06.077031 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:11.083667 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:16.091171 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:20.389414 0.187782 tcp 10.0.2.16 49501 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:35:20.577731 0.209881 tcp 10.0.2.16 49502 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:40:48.672936 3.000660 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:40:55.678868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:03.680893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:19.683653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:51.689592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:47:55.696939 3.000898 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:48:02.703031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:10.704945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:26.707907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:58.713811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:02.721199 3.000162 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:55:09.726861 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:17.728870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:33.731302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:56:05.737291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:09.745149 3.000130 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:02:16.750783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:24.752792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:40.755521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:03:12.761356 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:05:21.226418 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:05:21.226757 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:05:38.741550 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:05:56.431497 0.177557 tcp 10.0.2.16 49503 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:05:56.609318 0.211318 tcp 10.0.2.16 49504 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:05:56.821601 4.716286 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:56.934139 3.973506 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:56.935144 2.986617 tcp 10.0.2.16 49505 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:05:57.107106 4.095812 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1623 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:57.206943 0.172563 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:06:01.537427 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:05.920571 0.000000 tcp 10.0.2.16 49505 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:06:09.205146 0.173740 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 441 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:06:17.927654 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:22.935588 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:27.942591 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:09:16.769071 2.999958 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:09:23.775416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:31.776421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:47.779380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:10:19.785249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:23.793127 3.000094 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:16:30.799388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:38.800328 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:54.803678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:17:26.809183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:30.816479 3.000360 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:23:37.822676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:45.824556 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:24:01.827389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:24:33.833664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:37.841278 3.000178 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:30:44.847378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:52.848541 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:31:08.851867 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:31:40.857118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:36:42.000899 0.000191 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:36:42.001278 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:36:59.826795 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:16.224339 0.177810 tcp 10.0.2.16 49506 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:16.402590 0.205988 tcp 10.0.2.16 49507 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:16.609559 0.099522 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.709681 0.113743 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 773 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.710219 2.993987 tcp 10.0.2.16 49508 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:37:16.822507 0.174790 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.997815 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:25.703298 0.000000 tcp 10.0.2.16 49508 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:37:32.743719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:37.701323 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:42.708251 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:44.864961 3.000081 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:37:47.715503 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:48.037380 0.177448 tcp 10.0.2.16 49509 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:48.215066 0.203544 tcp 10.0.2.16 49510 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:51.871451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:37:59.872785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:38:15.875373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:38:47.881718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:44:51.888980 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:44:58.895046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:06.896053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:22.899633 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:54.905175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:51:58.914204 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:52:05.919366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:13.920394 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:29.923410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:53:01.929309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:05.936880 3.000011 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:59:12.942652 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:20.944590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:36.947412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:00:08.953143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:12.960660 3.000135 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:06:19.966598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:27.968198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:43.971487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:07:15.977367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:08:15.914451 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:08:15.914808 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:32.187080 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:47.433657 0.176739 tcp 10.0.2.16 49511 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:08:47.610815 0.208032 tcp 10.0.2.16 49512 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:08:47.819925 4.745635 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1612 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:47.920446 3.815073 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2141 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:47.920984 3.002427 tcp 10.0.2.16 49513 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:08:48.031666 4.235924 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:48.211191 0.178902 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 487 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:52.566098 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:56.922365 0.000000 tcp 10.0.2.16 49513 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:08:59.406424 0.177328 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:09:08.920256 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:09:13.926952 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:09:18.933981 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:13:19.985137 3.000112 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:13:26.991063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:34.992363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:50.995212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:14:23.000910 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:27.008901 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:20:34.014701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:42.016447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:58.019434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:21:30.025312 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:34.032607 3.000219 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:27:41.038268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:49.040240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:28:05.043609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:28:37.049307 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:41.056573 3.000645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:34:48.062628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:56.064361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:35:12.067216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:35:44.073000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:39:31.580540 0.000182 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:39:31.580906 0.114182 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:39:31.694543 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:31.695972 2.999014 tcp 10.0.2.16 49514 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:39:40.693240 0.000000 tcp 10.0.2.16 49514 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:39:47.412902 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:52.691022 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:57.698185 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:02.705100 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:03.701061 0.177429 tcp 10.0.2.16 49515 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:03.878769 0.210981 tcp 10.0.2.16 49516 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:04.090707 0.101782 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:40:04.193015 0.176381 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:40:04.369947 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:21.782887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:38.578642 0.180323 tcp 10.0.2.16 49517 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:38.759516 0.207006 tcp 10.0.2.16 49518 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:41:48.080462 3.000198 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:41:55.086572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:03.088438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:19.091400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:51.097010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:48:55.104807 3.000075 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:49:02.110558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:10.112132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:26.115685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:58.120961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:02.129111 2.999332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:56:09.134909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:17.135702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:33.138735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:57:05.144812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:09.152470 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:03:16.158263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:24.159795 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:40.163366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:04:12.168746 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:16.176283 3.000051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:10:23.182627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:31.184233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:44.633552 0.000164 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:10:44.633867 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:10:47.186587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:00.947073 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:17.655893 0.177866 tcp 10.0.2.16 49519 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:11:17.833446 0.211915 tcp 10.0.2.16 49520 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:11:18.046324 4.725756 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1898 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.158698 3.738150 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.159864 3.006220 tcp 10.0.2.16 49521 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:11:18.256024 4.179363 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.431286 0.172318 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:19.193496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:22.771040 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:27.164400 0.000000 tcp 10.0.2.16 49521 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:11:30.379049 0.174115 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 569 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:39.161981 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:44.169344 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:49.175893 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:17:23.199998 3.000868 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:17:30.206053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:38.207899 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:54.211224 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:18:26.217285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:30.224496 2.999918 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:24:37.230023 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:45.232292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:25:01.234570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:25:33.241146 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:37.248564 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:31:44.254174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:52.255549 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:32:08.259090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:32:40.264929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:44.272537 3.000137 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:38:51.278569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:59.280090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:39:15.283007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:39:47.289076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:41:52.288906 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:41:52.289249 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:07.571110 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:25.360566 1.780677 tcp 10.0.2.16 49522 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:42:25.542503 0.209090 tcp 10.0.2.16 49523 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:42:25.752587 0.175927 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:25.929119 0.097985 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:25.929656 2.991906 tcp 10.0.2.16 49524 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:42:26.027633 0.112189 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 579 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:26.138960 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:34.919922 0.000000 tcp 10.0.2.16 49524 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:42:43.733252 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:46.927340 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:51.934623 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:56.941760 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:43:02.071211 1.888463 tcp 10.0.2.16 49525 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:43:02.249347 0.208161 tcp 10.0.2.16 49526 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:45:51.296412 3.000107 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 18:45:58.301925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:06.303829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:22.306871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:54.312487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:52:58.320405 2.999692 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:53:05.325925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:13.327806 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:29.330607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:54:01.336741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:05.343960 3.000810 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:00:12.349976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:20.352087 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:36.354350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:01:08.360626 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:12.368215 2.999896 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:07:19.374571 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:27.375548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:43.378595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:08:15.384367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:13:26.572638 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:13:26.572991 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:13:45.379665 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:01.564800 0.177871 tcp 10.0.2.16 49527 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:14:01.742884 0.213199 tcp 10.0.2.16 49528 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:14:01.956634 4.711713 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1460 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.058252 3.978513 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.058577 2.998694 tcp 10.0.2.16 49529 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:14:02.232142 4.138149 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1949 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.344891 0.174774 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:06.668743 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:11.055975 0.000000 tcp 10.0.2.16 49529 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:14:14.600897 0.429851 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 534 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:19.390216 3.002390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 19:14:23.053717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 137 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:26.398424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:28.060901 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:33.067615 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:34.399819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:50.402496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:15:22.408757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:26.415963 3.000298 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:21:33.422383 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:41.423360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:57.426919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:22:29.432582 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:33.439669 3.001089 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:28:40.446150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:48.448165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:29:04.450403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:29:36.456264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:40.464243 2.999928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:35:47.469907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:55.471969 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:11.474160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:43.480480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:42:47.488269 2.999895 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:42:54.493903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:02.495898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:18.498272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:50.504215 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:44:19.205923 0.000193 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:44:19.206294 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:44:34.367529 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:44:53.289551 0.178263 tcp 10.0.2.16 49530 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:44:53.468339 0.215774 tcp 10.0.2.16 49531 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:44:53.685050 0.111520 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 433 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:53.795927 0.101606 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 255 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:53.796909 2.993195 tcp 10.0.2.16 49532 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:44:53.898056 0.173335 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 324 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:54.071903 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:02.798053 0.000000 tcp 10.0.2.16 49532 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:45:12.432295 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:14.806146 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:19.813179 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:24.820593 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:30.500482 0.178305 tcp 10.0.2.16 49533 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:45:30.679290 0.207049 tcp 10.0.2.16 49534 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:49:54.511722 3.000588 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 19:50:01.517914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:09.519511 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:25.522219 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:57.528849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:01.535601 3.000779 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:57:08.541706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:16.543955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:32.546800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:58:04.552802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:08.560114 3.000045 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:04:15.565893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:23.567708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:39.570034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:05:11.576619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:15.584307 2.999967 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:11:22.590004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:30.591660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:46.594045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:12:18.600689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:15:43.315100 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:15:43.315418 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:15:59.938641 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:15.165147 1.959027 tcp 10.0.2.16 49535 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:16:15.343068 0.217244 tcp 10.0.2.16 49536 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:16:15.561453 3.856247 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1380 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.659930 4.617043 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1982 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.660468 3.005368 tcp 10.0.2.16 49537 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:16:15.771023 4.171762 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.947497 0.175645 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:20.276065 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:24.664640 0.000000 tcp 10.0.2.16 49537 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:16:29.151133 0.174197 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 578 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:36.661638 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:41.668588 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:46.675740 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:18:22.607505 3.000753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 20:18:29.613923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:37.615034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:53.618473 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:19:25.624918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:29.631853 3.000072 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:25:36.637541 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:44.639426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:26:00.642036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:26:32.648551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:36.655636 3.000490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:32:43.661751 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:51.663058 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:33:07.666092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:33:39.671959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:43.679633 3.000392 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:39:50.685359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:58.687827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:40:14.689870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:40:46.695975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:46:42.628337 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:46:42.628638 0.097982 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 238 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:46:42.727364 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:46:42.728104 3.003983 tcp 10.0.2.16 49538 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:46:50.703893 3.000024 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:46:51.730960 0.000000 tcp 10.0.2.16 49538 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:46:57.709988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:46:58.731679 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:03.738406 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:05.711413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:08.745385 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:13.752961 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:17.061825 0.176676 tcp 10.0.2.16 49539 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:17.238981 0.208842 tcp 10.0.2.16 49540 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:17.448937 0.111971 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 470 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:47:17.560395 0.175661 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:47:17.736604 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:21.714223 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:34.082122 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:50.868543 0.178383 tcp 10.0.2.16 49541 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:51.047168 0.209793 tcp 10.0.2.16 49542 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:53.719888 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:53:57.728123 3.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:54:04.733656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:12.735671 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:28.738450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:55:00.747720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:04.751709 3.000367 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:01:11.757372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:19.759385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:35.761794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:02:07.768395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:11.775714 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:08:18.781240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:26.782934 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:42.786258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:09:14.792467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:18.799258 3.000769 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:15:25.805790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:33.806725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:49.809738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:16:21.816013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:18:07.658986 0.000348 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:18:07.659454 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:26.064773 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:42.723486 0.178050 tcp 10.0.2.16 49543 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:18:42.901813 0.210783 tcp 10.0.2.16 49544 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:18:43.113574 4.724870 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1767 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.212602 3.798305 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.213149 3.000608 tcp 10.0.2.16 49545 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:18:43.324907 4.219847 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1437 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.504562 0.173100 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 662 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:47.838977 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:52.212342 0.000000 tcp 10.0.2.16 49545 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:18:53.223752 0.179020 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:19:04.209717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:19:09.217053 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:19:14.224140 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:22:25.823454 3.000495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:22:32.829200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:40.831098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:56.834300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:23:28.840072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:32.847085 3.001041 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:29:39.853544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:47.855013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:30:03.857907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:30:35.864036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:39.871925 3.000009 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:36:46.877503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:54.878577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:37:10.881742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:37:42.887773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:43:46.895143 3.000706 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:43:53.901046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:01.903118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:17.906727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:49.912828 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:49:03.346334 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:49:03.346659 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:20.121006 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:39.011739 0.177276 tcp 10.0.2.16 49546 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:49:39.189457 0.213765 tcp 10.0.2.16 49547 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:49:39.404243 0.176759 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.581634 0.112160 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 652 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.582252 3.000729 tcp 10.0.2.16 49548 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:49:39.693469 0.097243 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.791349 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:48.581742 0.000000 tcp 10.0.2.16 49548 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:49:58.015154 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:00.578904 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:05.586342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:10.593548 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:15.311496 0.183271 tcp 10.0.2.16 49549 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:50:15.495309 0.224770 tcp 10.0.2.16 49550 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:50:53.918490 3.001142 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:51:00.925168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:08.927011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:24.930027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:56.936323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:00.943681 2.999956 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:58:07.949345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:15.950445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:31.953506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:59:03.959986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:07.967525 2.999762 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:05:14.973413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:22.975082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:38.977801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:06:10.983882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:14.991687 3.000019 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:12:21.997550 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:29.998822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:46.001573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:13:18.007513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:22.013517 3.002161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:19:29.021029 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:37.022546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:53.025612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:20:25.031948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:20:26.003456 0.000096 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:20:26.003646 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:20:43.759025 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:02.097919 0.177403 tcp 10.0.2.16 49551 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:21:02.275040 0.216231 tcp 10.0.2.16 49552 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:21:02.491841 4.088529 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1374 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.669711 4.534019 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2194 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.670026 3.000373 tcp 10.0.2.16 49553 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:21:02.780065 4.089177 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1624 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.878154 0.176878 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 383 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:07.202603 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:11.668524 0.000000 tcp 10.0.2.16 49553 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:21:13.160722 0.171480 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:23.676213 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:28.683782 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:33.690473 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:26:29.039341 3.000024 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:26:36.044849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:26:44.046859 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:00.049598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:32.055534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:36.063385 3.000061 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:33:43.068792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:51.070776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:34:07.073770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:34:39.079443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:43.087270 2.999828 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:40:50.093002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:58.094712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:41:14.097315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:41:46.104188 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:47:50.111671 3.000028 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:47:57.117092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:05.118814 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:21.121505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:53.128055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:51:33.118076 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:51:33.119267 0.178650 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 301 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:51:33.298651 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:33.299398 3.002477 tcp 10.0.2.16 49554 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:51:42.300955 0.000000 tcp 10.0.2.16 49554 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:51:49.531398 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:54.308053 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:59.315535 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:04.323003 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:05.639291 0.176396 tcp 10.0.2.16 49555 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:05.816105 0.206297 tcp 10.0.2.16 49556 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:06.023419 0.112187 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:52:06.134605 0.098058 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:52:06.233198 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:23.250474 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:40.236306 0.177486 tcp 10.0.2.16 49557 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:40.414007 0.224088 tcp 10.0.2.16 49558 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:54:57.134909 3.000491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:55:04.141178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:12.142298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:28.145889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:56:00.151543 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:04.159403 3.000203 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:02:11.164825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:19.166389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:35.169250 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:03:07.175362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:11.184123 2.999182 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:09:18.188897 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:26.190455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:42.193327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:10:14.199074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:18.207573 2.999453 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:16:25.213045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:33.214464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:49.217324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:17:21.223237 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:22:46.301186 0.000102 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:22:46.301398 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:05.137801 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:23.338906 0.176815 tcp 10.0.2.16 49559 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:23:23.516019 0.209816 tcp 10.0.2.16 49560 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:23:23.726811 4.729431 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:23.900006 3.723617 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2050 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:23.900557 2.988270 tcp 10.0.2.16 49561 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:23:24.012404 3.910653 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1567 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:24.113997 0.176053 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 726 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:25.230851 3.000304 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 23:23:28.456833 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:32.236847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:32.897533 0.000000 tcp 10.0.2.16 49561 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:23:33.910255 0.177482 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 502 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:40.238706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:44.906154 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:49.914028 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:54.919515 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:56.241169 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:24:28.247760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:32.254832 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:30:39.260535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:47.262160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:31:03.265529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:31:35.271477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:39.278833 3.000186 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:37:46.285262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:54.286528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:38:10.289428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:38:42.295154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:44:46.301318 3.002044 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:44:53.308692 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:01.309861 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:17.313705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:49.319103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:51:53.327277 2.999493 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:52:00.332768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:08.334377 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:24.337089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:56.343874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:53:44.012513 0.000084 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:53:44.012719 0.113336 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:53:44.125732 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:53:44.126772 2.999140 tcp 10.0.2.16 49562 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:53:53.125091 0.000000 tcp 10.0.2.16 49562 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:54:01.857400 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:05.122218 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:10.129269 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:15.136899 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:19.397650 0.178932 tcp 10.0.2.16 49563 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:19.576985 0.209842 tcp 10.0.2.16 49564 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:19.787839 0.172580 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:54:19.961019 0.097826 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:54:20.059471 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:36.547564 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:51.631425 0.179661 tcp 10.0.2.16 49565 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:51.811425 0.213607 tcp 10.0.2.16 49566 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:59:00.350856 3.000222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 23:59:07.357019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:15.358028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:31.361514 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:00:03.367528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:07.375520 2.999379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:06:14.381230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:22.382110 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:38.384872 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:07:10.391209 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:14.396755 3.001897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:13:21.405055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:29.405883 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:45.409082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:14:17.415062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:21.422363 3.000449 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:20:28.428853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:36.430221 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:52.433187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:21:24.439198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:25:02.252157 0.000135 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:25:02.252411 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:19.267461 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:34.513306 0.179331 tcp 10.0.2.16 49567 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:25:34.693122 0.211653 tcp 10.0.2.16 49568 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:25:34.905729 4.723842 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2070 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.018844 3.983559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.019984 3.003830 tcp 10.0.2.16 49569 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:25:35.195452 4.097641 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.292123 0.178713 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 680 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:39.628809 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:44.022062 0.000000 tcp 10.0.2.16 49569 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:25:44.823697 0.174677 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 568 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:56.020415 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:26:01.026729 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:26:06.034245 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:27:28.447191 2.999362 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 00:27:35.452299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:43.454149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:59.457193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:28:31.463148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:35.470974 2.999844 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:34:42.476424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:50.477796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:35:06.481035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:35:38.486733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:42.495096 2.999324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:41:49.500774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:57.502194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:42:13.504903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:42:45.511212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:48:49.519077 2.999654 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:48:56.524192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:04.525618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:20.528951 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:52.534723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:55:56.542725 3.000277 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:56:03.548449 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:06.552548 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:56:06.552809 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:11.550395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:22.535674 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:27.553128 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:40.244172 0.178396 tcp 10.0.2.16 49570 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:56:40.422925 0.209464 tcp 10.0.2.16 49571 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:56:40.633415 0.098686 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 251 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:40.732824 0.111454 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:40.733410 3.002660 tcp 10.0.2.16 49572 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:56:40.843964 0.176673 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:41.021281 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:49.734769 0.000000 tcp 10.0.2.16 49572 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:56:56.594912 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:59.558912 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:57:01.732611 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:06.739189 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:11.746958 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:12.810268 0.177101 tcp 10.0.2.16 49573 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:57:12.987581 0.245436 tcp 10.0.2.16 49574 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:03:03.566875 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:03:10.572817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:18.573935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:34.576892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:04:06.582606 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:10.590585 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:10:17.596322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:25.597791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:41.601072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:11:13.606540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:17.614084 3.000434 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:17:24.620355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:32.622252 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:48.624628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:18:20.631028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:24.636917 3.002033 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:24:31.644099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:39.645551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:55.649065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:25:27.654946 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:27:15.299891 0.000125 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:27:15.300250 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:34.127092 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:49.441381 0.179346 tcp 10.0.2.16 49575 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:27:49.621189 0.216783 tcp 10.0.2.16 49576 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:27:49.839196 4.741195 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2105 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:49.950315 3.744356 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:49.950939 3.002808 tcp 10.0.2.16 49577 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:27:50.048773 4.181482 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1699 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:50.228815 0.173719 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 548 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:54.598323 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:58.952164 0.000000 tcp 10.0.2.16 49577 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:28:01.856912 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:07.274803 0.175734 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 618 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:28:10.949990 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:15.956896 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:20.964001 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:31:31.662264 3.000217 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 01:31:38.668470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:31:46.669636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:32:02.672843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:32:34.678532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:38.686094 3.000347 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:38:45.692284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:53.693574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:39:09.696420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:39:41.703069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:45:45.710133 3.000673 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:45:52.716571 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:00.717648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:16.720603 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:48.726959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:52:52.732377 3.002470 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:52:59.740197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:07.741352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:23.744936 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:55.751060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:58:36.594571 0.000203 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:58:36.594947 0.097516 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:58:36.692908 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:58:36.693333 2.995496 tcp 10.0.2.16 49578 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:58:45.697198 0.000000 tcp 10.0.2.16 49578 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:58:52.037101 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:58:57.695370 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:02.701946 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:07.709372 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:09.356053 0.179512 tcp 10.0.2.16 49579 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:09.536036 0.206215 tcp 10.0.2.16 49580 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:09.743432 0.126361 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 454 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:59:09.857185 0.175409 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:59:10.033218 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:25.585152 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:43.793270 0.178799 tcp 10.0.2.16 49581 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:43.972543 0.213903 tcp 10.0.2.16 49582 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:59.758115 3.000529 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:00:06.764284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:14.765743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:30.768833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:01:02.774576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:06.782549 2.999801 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:07:13.787741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:21.789745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:37.792715 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:08:09.798446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:13.806033 3.000630 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:14:20.811825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:28.813812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:44.816702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:15:16.822654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:20.830207 3.000148 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:21:27.836088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:35.837493 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:51.840390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:22:23.846882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:27.854383 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:28:34.859889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:42.861869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:58.864441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:29:30.871077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:29:58.891327 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:29:58.891619 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:15.735783 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:31.662924 0.175911 tcp 10.0.2.16 49583 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:30:31.839408 0.208620 tcp 10.0.2.16 49584 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:30:32.049071 4.808437 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1410 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.147686 3.889643 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2037 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.148250 2.994747 tcp 10.0.2.16 49585 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 02:30:32.288649 4.275162 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.466248 0.174387 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:36.858025 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:41.141818 0.000000 tcp 10.0.2.16 49585 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 02:30:41.963312 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 308 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:49.273510 0.179917 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 473 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:52.447798 0.527367 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1106 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:52.975786 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:53.139676 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:58.146494 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:01.140705 0.178245 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 475 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:03.153413 1.827840 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1455 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:04.314763 0.375333 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1529 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:04.981644 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:10.664230 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:15.591454 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:31:16.893545 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:24.113881 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:29.902627 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:36.841534 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:45.493958 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:52.424167 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:57.090857 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:31:58.994002 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:05.753726 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:12.593273 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:18.712419 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:35:34.878215 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:35:41.884214 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:35:49.885721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:36:05.888821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:36:37.894376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:41.902375 3.000582 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:42:48.908864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:56.910546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:43:12.912041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:43:44.918689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:49:48.925828 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:49:55.931494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:03.933626 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:19.936366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:51.942316 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:56:55.949561 3.000911 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:57:02.955879 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:10.957291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:26.960185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:58.966580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:02:27.723734 0.000175 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:02:27.724084 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:02:46.319887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:03.649030 0.382808 tcp 10.0.2.16 49586 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:04.032383 0.202925 tcp 10.0.2.16 49587 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:04.236264 0.270861 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:03:04.507858 0.122805 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:03:04.508390 3.001650 tcp 10.0.2.16 49588 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:03:04.630181 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:13.508816 0.000000 tcp 10.0.2.16 49588 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:03:21.810669 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:25.516557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:30.523441 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:35.530352 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:38.606798 0.179037 tcp 10.0.2.16 49589 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:38.785670 0.210858 tcp 10.0.2.16 49590 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:38.997498 0.103603 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:04:02.974163 2.999586 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:04:09.979932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:17.981306 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:33.984230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:05:05.990566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:09.998242 2.999788 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:11:17.003896 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:25.005236 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:41.008013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:12:13.013992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:17.020525 3.001347 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:18:24.027664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:32.028938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:48.032366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:19:20.038198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:24.046018 3.000096 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:25:31.051544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:39.052905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:55.056231 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:26:27.061938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:31.069622 3.000367 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:32:38.075444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:46.077159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:02.080647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:34.086592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:39.364308 0.000151 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:33:39.364623 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:33:57.941041 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:14.999391 0.177762 tcp 10.0.2.16 49591 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:15.177398 0.210966 tcp 10.0.2.16 49592 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:15.388933 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:30.547584 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:45.741294 0.178228 tcp 10.0.2.16 49593 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:45.919944 0.210777 tcp 10.0.2.16 49594 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:46.131838 0.268840 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.401440 0.136828 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 649 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.402034 3.002728 tcp 10.0.2.16 49595 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:34:46.537698 0.096885 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 271 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.635057 0.273920 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 408 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:49.906553 0.276177 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 634 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.179920 0.407725 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.587141 0.290461 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1235 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.878075 0.807053 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1191 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:54.685763 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:55.403075 0.000000 tcp 10.0.2.16 49595 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:35:03.434847 0.280819 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:35:07.400654 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:35:12.408483 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:35:17.415765 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:39:38.093460 3.000413 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:39:45.099932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:39:53.101641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:09.104189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:41.110837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:46:45.117840 3.000483 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:46:52.123855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:00.124980 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:16.128275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:48.134100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:53:52.141588 3.000994 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:53:59.147731 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:07.149272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:23.152471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:55.158581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:00:59.165581 3.000277 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:01:06.171565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:14.172902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:30.175880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:02:02.182478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:05:23.761926 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:05:23.762270 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:05:39.985514 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:05:57.796067 0.375868 tcp 10.0.2.16 49596 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:05:58.172439 0.242155 tcp 10.0.2.16 49597 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:05:58.415170 0.141165 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 770 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:05:58.555622 0.098458 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 341 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:05:58.555955 2.999911 tcp 10.0.2.16 49598 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:05:58.654522 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:07.554667 0.000000 tcp 10.0.2.16 49598 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:16.587878 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:19.553006 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 93 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:24.559626 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:29.566919 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:35.286771 0.177198 tcp 10.0.2.16 49599 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:06:35.464334 0.211712 tcp 10.0.2.16 49600 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:06:35.677003 0.269368 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:06:35.947019 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:35.947658 2.992169 tcp 10.0.2.16 49601 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:44.938685 0.000000 tcp 10.0.2.16 49601 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:51.578123 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:56.946675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:01.953336 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:06.960013 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:08.855804 1.893043 tcp 10.0.2.16 49602 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:07:09.033339 0.213398 tcp 10.0.2.16 49603 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:08:06.189435 3.000672 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:08:13.195782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:21.196972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:37.200008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:09:09.206114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:13.213656 2.999731 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:15:20.219494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:28.220713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:44.224480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:16:16.230272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:20.237592 3.000316 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:22:27.243598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:35.244596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:51.248084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:23:23.253711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:27.259397 3.002183 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:29:34.267325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:42.269064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:58.272078 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:30:30.278118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:34.285712 3.000190 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:36:41.291510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:49.292609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:05.295670 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:20.668654 0.000097 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:37:20.668859 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:37:37.302234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:38.193488 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:37:54.401143 0.191203 tcp 10.0.2.16 49604 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:37:54.591895 0.209566 tcp 10.0.2.16 49605 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:37:54.802460 4.917138 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 920 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:54.956386 3.939734 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:54.957608 2.994115 tcp 10.0.2.16 49606 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:37:55.054460 4.664523 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1496 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:55.328687 0.277635 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 656 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:59.875921 0.313076 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1506 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:00.188032 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:03.950235 0.000000 tcp 10.0.2.16 49606 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:05.903957 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:14.885886 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:15.957344 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:20.964876 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:22.747653 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:25.971989 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:29.445974 0.270451 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:32.711690 0.814801 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1174 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:33.527013 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:33.527381 2.999714 tcp 10.0.2.16 49607 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:37.588285 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:38:38.971118 0.272966 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 572 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.245822 0.439800 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1810 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.525309 0.000000 tcp 10.0.2.16 49607 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:42.685070 0.292357 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1200 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.977984 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:50.337242 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:54.523317 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:59.270295 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:59.529927 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:04.277316 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:04.537683 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:13.220075 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:21.692313 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:26.588851 0.000209 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:39:27.520705 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 295 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:33.348699 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:41.651353 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:49.211977 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:54.600036 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:40:02.140185 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:43:41.309264 3.000782 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:43:48.315523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:43:56.317053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:44:12.320185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:44:44.326166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:50:48.333559 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:50:55.339482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:03.340933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:19.343643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:51.349767 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:57:55.355800 3.001766 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:58:02.363668 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:10.365047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:26.368194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:58.374321 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:02.380961 3.000687 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:05:09.387635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:17.388442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:33.391438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:06:05.398108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:10:27.284542 0.000086 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:10:27.284720 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:10:44.619917 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:01.108558 0.203130 tcp 10.0.2.16 49608 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:01.312146 0.212460 tcp 10.0.2.16 49609 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:01.525612 0.272593 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:01.798812 0.148874 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 533 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:01.799409 2.998564 tcp 10.0.2.16 49610 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:01.947332 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:10.807104 0.000000 tcp 10.0.2.16 49610 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:20.450619 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:22.804278 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:27.811625 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:32.818986 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:37.647557 0.178194 tcp 10.0.2.16 49611 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:37.825978 0.232853 tcp 10.0.2.16 49612 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:38.059830 0.101095 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:38.161816 2.998856 tcp 10.0.2.16 49613 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:47.159177 0.000000 tcp 10.0.2.16 49613 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:59.166868 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:04.173529 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:09.181380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:09.405269 2.999815 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:12:16.410821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:24.412834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:40.415367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:13:12.421424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:16.429055 2.999977 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:19:23.434850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:31.436347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:47.439724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:20:19.446041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:23.453467 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:26:30.459192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:38.460921 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:54.463430 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:27:26.469695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:30.477560 3.000333 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:33:37.483481 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:45.484858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:34:01.487818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:34:33.493576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:37.501224 3.000019 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:40:44.506725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:52.508878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:08.511981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:38.305114 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:41:38.305440 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:41:40.517489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:53.936901 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:10.686158 0.201702 tcp 10.0.2.16 49614 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:10.888384 0.215252 tcp 10.0.2.16 49615 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:11.104594 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:26.994421 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:45.882631 0.178054 tcp 10.0.2.16 49616 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:46.060877 0.209397 tcp 10.0.2.16 49617 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:46.271314 0.271262 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.543182 0.136583 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 538 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.543852 3.002728 tcp 10.0.2.16 49618 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:42:46.679288 0.097493 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 331 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.777461 0.271611 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 658 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:50.047659 0.270518 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:53.322746 0.425062 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1503 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:53.746956 0.290849 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:54.038333 0.811088 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:54.850026 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:55.545297 0.000000 tcp 10.0.2.16 49618 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:43:01.784760 0.270751 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:43:07.543223 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:43:12.550477 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:43:17.557485 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:47:44.525062 3.000547 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:47:51.531044 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:47:59.532556 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:48:15.535409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:48:47.541263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:54:51.548763 3.000379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:54:58.554873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:06.556969 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:22.559360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:54.565590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:01:58.573400 2.999522 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:02:05.579270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:13.580776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:29.583694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:03:01.589625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:05.597479 2.999416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:09:12.602629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:20.604203 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:36.607787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:10:08.613516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:13:28.221127 0.000198 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:13:28.221543 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:13:45.665687 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:03.676268 0.202257 tcp 10.0.2.16 49619 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:03.879045 0.211162 tcp 10.0.2.16 49620 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:04.091271 0.144455 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 541 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:04.234411 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:04.235013 3.001247 tcp 10.0.2.16 49621 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:14:13.235329 0.000000 tcp 10.0.2.16 49621 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:14:20.536247 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:25.232829 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:30.239598 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:35.246951 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:36.710920 0.205906 tcp 10.0.2.16 49622 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:36.917281 0.210707 tcp 10.0.2.16 49623 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:37.128959 0.273066 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:37.402544 0.100450 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:37.503710 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:52.992423 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:15:11.461573 0.201741 tcp 10.0.2.16 49624 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:15:11.662890 0.214462 tcp 10.0.2.16 49625 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:16:12.621282 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 06:16:19.627196 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:27.628374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:43.631309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:17:15.637756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:19.645113 2.999649 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:23:26.650647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:34.652229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:50.655132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:24:22.661439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:26.668906 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:30:33.674588 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:41.676388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:57.679742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:31:29.685662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:33.693137 2.999522 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:37:40.698957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:48.700616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:38:04.703251 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:38:36.709381 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:40.717027 2.999984 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:44:47.722435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:55.724396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:11.727385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:11.987744 0.000160 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:45:11.988088 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:28.992328 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:43.733038 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:45.330878 0.183809 tcp 10.0.2.16 49626 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:45:45.514921 0.210181 tcp 10.0.2.16 49627 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:45:45.726197 4.145171 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:45.854112 4.874568 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1367 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:45.855014 2.996000 tcp 10.0.2.16 49628 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:45:46.126420 4.055008 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:46.231817 0.275849 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:50.999258 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:50.999818 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:54.849139 0.000000 tcp 10.0.2.16 49628 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:45:59.185760 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:06.338505 0.271029 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 711 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:06.856870 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:09.611038 0.825688 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1384 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:10.437326 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:11.864130 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:16.871374 4.438724 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1845 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:17.692577 0.279356 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 713 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:21.309360 0.295578 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:21.605548 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:29.489505 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:34.085704 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:46:38.372113 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:46.653737 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:55.476917 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:02.967642 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:11.499650 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:16.085761 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:47:17.007485 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:22.796294 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:28.243921 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:35.104243 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:42.985524 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:51:47.740693 3.000012 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 06:51:54.746379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:02.748070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:18.751402 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:50.757308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:58:54.765136 2.999697 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:59:01.770691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:09.772112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:25.774832 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:57.781074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:01.789083 2.999511 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:06:08.794583 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:16.796234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:32.799011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:07:04.805429 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:08.811091 3.001549 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:13:15.818460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:23.820080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:39.822949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:14:11.829114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:17:54.469265 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:17:54.470347 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:11.774668 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:27.751788 0.269334 tcp 10.0.2.16 49629 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:18:28.021456 0.234787 tcp 10.0.2.16 49630 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:18:28.257251 0.297415 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 234 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.555444 0.115024 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 708 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.556029 2.996513 tcp 10.0.2.16 49631 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:18:28.669878 0.101608 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 248 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.772084 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:37.551650 0.000000 tcp 10.0.2.16 49631 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:18:44.230915 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:49.548931 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:54.556326 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:59.563144 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:19:02.359132 0.176921 tcp 10.0.2.16 49632 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:19:02.536396 0.205978 tcp 10.0.2.16 49633 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:20:15.835245 3.001804 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 07:20:22.842709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:30.844570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:46.847379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:21:18.853313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:22.860880 2.999713 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:27:29.866879 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:37.867784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:53.871487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:28:25.877289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:29.884344 3.000274 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:34:36.890286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:44.891898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:35:00.894684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:35:32.901885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:36.909848 2.999118 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:41:43.914505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:51.915836 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:42:07.919375 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:42:39.924718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:43.932826 2.999818 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:48:50.938621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:58.939696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:14.943482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:30.054937 0.000147 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:49:30.055239 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:49:46.949310 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:48.982117 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:07.713489 0.203961 tcp 10.0.2.16 49634 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:07.917826 0.209059 tcp 10.0.2.16 49635 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:08.128089 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:26.826727 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:45.815248 0.202118 tcp 10.0.2.16 49636 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:46.017626 0.209334 tcp 10.0.2.16 49637 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:46.228125 0.112000 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.339115 0.272559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 365 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.339794 2.998796 tcp 10.0.2.16 49638 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:50:46.612226 0.100454 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 227 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.713341 0.271805 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 648 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:49.989505 0.274615 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 654 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:53.264654 0.814631 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1117 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.079901 0.301820 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.382260 0.339033 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1583 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.720529 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:55.347390 0.000000 tcp 10.0.2.16 49638 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:03.329058 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:07.344789 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:11.411107 0.272007 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:12.352116 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:14.685631 0.815034 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1204 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:15.501294 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:17.358913 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:22.276793 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:30.318238 0.333418 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:30.651411 0.294360 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:30.652221 2.999889 tcp 10.0.2.16 49639 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:30.946371 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:35.084278 0.000099 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:51:38.870466 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:39.650607 0.000000 tcp 10.0.2.16 49639 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:44.117380 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:51.648915 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:53.000745 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:56.655920 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:00.060207 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:01.662552 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:07.350869 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:12.598220 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:17.585417 0.000184 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:52:18.577253 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:25.717937 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:32.667688 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:40.649121 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:46.146798 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:52.535916 0.271970 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:52:55.810566 0.277937 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:56.088503 0.000000 icmp 66.36.228.41 0x0303 -> 10.0.2.16 0xb634 URP 192 1 322 flow=Background 1970/01/03 07:53:00.587084 0.000199 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:55:50.956512 3.000405 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 07:55:57.962055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:05.963570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:21.966684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:53.972880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:02:57.980457 3.000087 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:03:04.986386 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:12.988315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:28.990512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:04:00.996631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:05.225169 3.000769 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:10:12.230740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:20.231809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:36.234933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:11:08.241097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:12.249093 2.999851 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:17:19.254290 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:27.256364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:43.259291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:18:15.264902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:23:22.397655 0.000124 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:23:22.397992 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:23:39.090786 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:23:54.247214 0.185918 tcp 10.0.2.16 49640 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:23:54.433558 0.211105 tcp 10.0.2.16 49641 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:23:54.645653 0.273559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:54.919638 0.113013 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 746 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:54.919964 3.007639 tcp 10.0.2.16 49642 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:23:55.032107 0.097382 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 226 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:55.130034 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:03.926673 0.000000 tcp 10.0.2.16 49642 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:24:12.448915 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:15.924156 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:19.272847 2.999873 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 08:24:20.930784 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:25.938446 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:26.278699 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:28.273868 1.891856 tcp 10.0.2.16 49643 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:24:28.452624 0.210943 tcp 10.0.2.16 49644 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:24:34.280200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:50.283580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:25:22.289004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:26.296807 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:31:33.302483 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:41.303991 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:57.306972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:32:29.313217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:33.320396 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:38:40.326490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:48.328596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:39:04.331341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:39:36.336723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:40.344466 3.000577 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:45:47.350184 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:55.352302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:46:11.355754 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:46:43.361349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:52:47.368697 2.999915 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:52:54.374154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:02.375623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:18.378602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:50.384947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:54:51.273083 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:54:51.273409 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:09.939883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:28.680776 0.178080 tcp 10.0.2.16 49645 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:55:28.859181 0.211408 tcp 10.0.2.16 49646 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:55:29.071575 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:45.260000 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:03.658560 0.178843 tcp 10.0.2.16 49647 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:56:03.837817 0.210125 tcp 10.0.2.16 49648 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:56:04.048932 0.275857 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 360 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.325434 0.113083 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 726 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.326008 2.996141 tcp 10.0.2.16 49649 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:04.438048 0.097606 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.536118 0.272532 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 441 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:07.812978 0.274422 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 703 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.087271 0.334055 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.420701 0.289803 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.711018 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:13.320071 0.000000 tcp 10.0.2.16 49649 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:17.486458 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:23.455442 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:25.327948 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:30.335300 4.989960 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:31.227684 0.271163 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:35.325944 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:35.342174 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:41.821179 0.274143 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.096694 0.334284 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1584 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.431313 0.304182 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1037 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.431885 2.999163 tcp 10.0.2.16 49650 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:45.736088 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:46.708199 0.000123 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:56:51.736168 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:54.429247 0.000000 tcp 10.0.2.16 49650 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:59.967631 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:06.436971 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:08.529726 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:11.444116 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:14.429500 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:16.451759 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:19.806172 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:26.686418 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:31.212064 0.000133 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:57:35.519007 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:43.540679 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:52.332723 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:58.040994 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:58:05.051580 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:59:54.392388 3.000203 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 09:00:01.398225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:09.400341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:25.403292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:57.408929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:01.414803 3.001687 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:07:08.421953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:16.423993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:32.427094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:08:04.432842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:08.440660 2.999888 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:14:15.446684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:23.447486 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:39.451198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:15:11.456696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:15.462147 3.002327 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:21:22.470262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:30.472150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:46.474734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:22:18.481013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:22.486909 3.001222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:28:29.493979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:37.495661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:40.720634 0.000078 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:28:40.720798 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:28:53.498715 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:59.327407 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:16.774944 0.177305 tcp 10.0.2.16 49651 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:16.952012 0.214664 tcp 10.0.2.16 49652 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:17.167240 0.276299 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 285 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.443964 0.113074 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 627 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.444299 3.002939 tcp 10.0.2.16 49653 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 09:29:17.556444 0.101547 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.658421 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:25.504874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:29:26.446334 0.000000 tcp 10.0.2.16 49653 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 09:29:33.325861 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:38.443491 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:43.450447 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:48.457985 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:51.223443 0.181656 tcp 10.0.2.16 49654 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:51.405251 0.206365 tcp 10.0.2.16 49655 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:35:29.512591 2.999836 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:35:36.517933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:35:44.519859 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:00.522690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:32.528771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:36.536994 2.999699 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:42:43.542076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:51.543819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:07.546523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:39.552721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:49:43.558461 3.002158 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:49:50.566267 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:49:58.567691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:14.571006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:46.576514 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:56:50.584176 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:56:57.590191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:05.592133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:21.594452 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:53.601129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:00:08.724947 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:00:08.725249 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:00:27.311640 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:00:44.188711 0.177916 tcp 10.0.2.16 49656 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:00:44.367125 0.210464 tcp 10.0.2.16 49657 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:00:44.578573 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:00.529321 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:15.643416 0.179303 tcp 10.0.2.16 49658 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:01:15.822884 0.208444 tcp 10.0.2.16 49659 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:01:16.032415 0.112827 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 639 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.144588 0.272068 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.145695 3.000184 tcp 10.0.2.16 49660 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:01:16.417232 0.097158 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 300 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.515109 0.276710 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 533 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:19.787422 0.279086 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 607 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:23.062331 0.818368 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1336 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:23.881236 0.290765 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:24.172493 0.332741 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1711 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:24.504202 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:25.144699 0.000000 tcp 10.0.2.16 49660 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:01:31.834789 0.277177 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 482 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:35.122271 0.818276 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1184 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:35.941097 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:37.142377 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:42.149708 4.268176 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1677 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:42.810683 0.278418 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:46.417317 0.290197 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:46.708144 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:47.156608 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:54.647384 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:59.203417 0.000132 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:02:01.547006 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:10.049366 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:17.029663 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:23.699005 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:30.209023 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:36.907897 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:41.705010 0.000091 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:02:43.808284 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:50.758090 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:55.935635 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:03:01.173271 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:03:57.608132 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 10:04:04.614064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:12.615610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:28.618939 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:05:00.624446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:04.632198 3.000073 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:11:11.637684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:19.639808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:35.642212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:12:07.648565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:11.656595 2.999755 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:18:18.662339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:26.663782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:42.666279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:19:14.672906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:18.679897 3.000700 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:25:25.685681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:33.687517 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:49.690579 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:26:21.696691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:25.704559 2.999606 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:32:32.710276 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:40.711202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:56.714309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:28.720555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:37.202785 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:33:37.203069 0.273892 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 367 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:33:37.477645 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:33:37.478409 3.008930 tcp 10.0.2.16 49661 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:33:46.485870 0.000000 tcp 10.0.2.16 49661 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:33:53.836641 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:33:58.483783 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:03.490384 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:08.497666 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:09.383200 0.178484 tcp 10.0.2.16 49662 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:09.562127 0.215014 tcp 10.0.2.16 49663 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:09.778146 0.112687 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 777 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:34:09.890451 0.097140 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:34:09.988126 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:27.274653 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:44.570791 0.177742 tcp 10.0.2.16 49664 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:44.749022 0.205392 tcp 10.0.2.16 49665 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:39:32.728209 2.999598 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 10:39:39.733930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:39:47.735359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:03.738874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:35.744863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:46:39.752791 2.999817 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:46:46.758363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:46:54.759659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:10.762387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:42.768675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:53:46.775788 3.000624 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:53:53.782000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:01.783144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:17.786036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:49.792903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:00:53.800033 3.000004 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:01:00.806240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:08.807156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:24.810223 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:56.816006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:05:07.250777 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:05:07.251157 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:23.233383 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:41.143541 1.886624 tcp 10.0.2.16 49666 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:05:41.322926 0.204174 tcp 10.0.2.16 49667 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:05:41.528186 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:59.766139 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:16.181661 0.181142 tcp 10.0.2.16 49668 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:06:16.362642 0.210923 tcp 10.0.2.16 49669 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:06:16.574119 0.279918 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:16.854476 0.112598 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 765 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:16.854824 2.999711 tcp 10.0.2.16 49670 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:06:16.966344 0.098817 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:17.065599 0.272548 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:20.335600 0.276463 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 646 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:23.610102 0.837007 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1397 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:24.447848 0.295685 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:24.744078 0.333638 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:25.077189 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:25.853411 0.000000 tcp 10.0.2.16 49670 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:06:33.234369 0.272634 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:36.509303 1.341415 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:37.345682 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:42.857584 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:45.541368 0.275541 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:47.864626 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:48.816170 0.333090 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:49.148825 0.296185 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1281 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:49.445620 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:55.406247 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:00.202408 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:07:01.084086 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:07.403176 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:14.072690 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:19.871091 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:27.712334 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:34.992462 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:40.280135 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:45.207466 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:07:48.522095 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:54.711462 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:08:00.823969 3.000174 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 11:08:02.612834 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:08:07.829686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:15.831408 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:31.834535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:09:03.840116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:07.847546 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:15:14.853733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:22.855703 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:38.858171 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:16:10.864593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:14.871643 3.000611 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:22:21.877707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:29.879170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:45.881864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:23:17.887996 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:21.895569 3.000508 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:29:28.901468 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:36.902973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:52.906222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:30:24.911876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:28.917591 3.001928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:36:35.925349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:43.926976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:59.930286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:37:31.936507 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:38:35.628380 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:38:35.628706 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:38:50.970200 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:06.615033 0.176205 tcp 10.0.2.16 49671 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:06.791429 0.211011 tcp 10.0.2.16 49672 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:07.003029 0.271412 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 231 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:07.274899 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:07.275355 3.002122 tcp 10.0.2.16 49673 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:16.276679 0.000000 tcp 10.0.2.16 49673 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:25.509389 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:28.273940 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:33.281212 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:38.288334 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:44.228761 0.179004 tcp 10.0.2.16 49674 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:44.408222 0.208846 tcp 10.0.2.16 49675 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:44.618107 0.097748 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 368 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:44.716434 0.112135 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:44.717007 2.994535 tcp 10.0.2.16 49676 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:53.709609 0.000000 tcp 10.0.2.16 49676 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:40:05.717346 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:40:10.725028 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:40:15.731478 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:43:35.943697 3.000151 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 11:43:42.949603 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:43:50.951388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:06.954456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:38.960173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:50:42.967605 3.000572 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:50:49.973447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:50:57.975474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:13.978433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:45.983792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:57:49.991298 3.000373 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:57:56.997291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:04.998798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:21.002424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:53.008623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:04:57.015105 3.000466 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:05:04.022222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:12.024162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:28.025872 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:06:00.032338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:09:52.245888 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:09:52.246223 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:07.638305 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:23.485734 0.178452 tcp 10.0.2.16 49677 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:23.664596 0.205538 tcp 10.0.2.16 49678 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:23.871107 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:41.326422 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:56.661066 0.177929 tcp 10.0.2.16 49679 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:56.839451 0.204388 tcp 10.0.2.16 49680 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:57.044861 0.272587 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.318131 0.112883 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 642 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.318731 3.005278 tcp 10.0.2.16 49681 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:10:57.430214 0.097621 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.528525 0.274938 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 529 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:00.804356 0.272977 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.079773 0.334754 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1470 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.413663 0.294935 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1100 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.709118 0.818696 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1144 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:05.528370 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:06.322309 0.000000 tcp 10.0.2.16 49681 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:11:12.481587 0.275440 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:15.755784 2.563930 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:16.583414 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:22.515730 0.271529 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 444 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:23.327369 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:25.790793 0.336109 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:26.125771 0.292986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:26.419480 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:28.334675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:34.273008 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:39.209489 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:11:39.490439 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:47.221807 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:52.999616 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:01.161353 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:04.038009 3.001461 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:12:09.453144 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:11.045433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:14.871416 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:19.046613 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:22.261426 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:27.209146 0.000159 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:12:29.281680 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:35.049733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:36.993266 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:45.335086 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 296 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:13:07.055734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:11.063488 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:19:18.069753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:26.071351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:42.074227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:20:14.080096 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:18.087980 2.999990 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:26:25.093565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:33.095028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:49.098005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:27:21.103964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:25.112067 2.999501 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:33:32.117811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:40.118532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:56.122227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:34:28.127923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:32.135505 2.999788 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:40:39.141051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:47.142580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:03.145870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:35.151649 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:43:04.800576 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:43:04.800937 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:21.885885 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:37.980845 0.180009 tcp 10.0.2.16 49682 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:43:38.160522 0.210499 tcp 10.0.2.16 49683 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:43:38.372116 0.269742 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 340 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:43:38.642488 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:38.643090 3.000935 tcp 10.0.2.16 49684 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:43:47.642639 0.000000 tcp 10.0.2.16 49684 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:43:56.225439 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:59.640015 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:04.646504 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:09.654379 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:14.773832 0.178095 tcp 10.0.2.16 49685 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:44:14.952276 0.205685 tcp 10.0.2.16 49686 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:44:15.158922 0.099507 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:44:15.258903 0.112381 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 671 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:44:15.259244 2.997354 tcp 10.0.2.16 49687 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:44:24.255101 0.000000 tcp 10.0.2.16 49687 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:44:36.252807 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:41.259541 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:46.266682 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:47:39.157730 3.001740 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:47:46.165458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:47:54.167073 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:10.170085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:42.175909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:54:46.183468 2.999718 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:54:53.188998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:01.190840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:17.193716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:49.199868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:01:53.207494 2.999922 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:02:00.213427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:08.215091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:24.217976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:56.224068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:00.231607 3.000221 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:09:07.237180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:15.238730 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:31.241631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:10:03.248351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:14:20.738457 0.000180 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:14:20.738806 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:14:36.751368 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:14:54.210973 0.178740 tcp 10.0.2.16 49688 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:14:54.390077 0.212736 tcp 10.0.2.16 49689 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:14:54.604005 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:13.553862 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:28.607488 0.176584 tcp 10.0.2.16 49690 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:15:28.784639 0.205044 tcp 10.0.2.16 49691 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:15:28.990242 0.258050 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 395 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.248959 0.112670 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.249532 3.001107 tcp 10.0.2.16 49692 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:15:29.360779 0.098109 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 332 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.459695 0.258669 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:32.721647 0.265099 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 630 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:35.986245 0.334443 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1751 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:36.320331 0.293291 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1373 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:36.614175 0.802269 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1409 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:37.416981 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:38.249457 0.000000 tcp 10.0.2.16 49692 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:15:46.391436 0.266135 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 510 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:49.656226 0.805344 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1378 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:50.462179 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:55.264082 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:56.035616 0.266972 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.300086 0.335346 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.635062 0.293074 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.928747 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:00.271528 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:06.910874 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:07.255434 3.000284 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:16:11.707568 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:16:13.670368 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:14.261325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:21.912393 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 311 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:22.262496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:28.411906 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:36.853494 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:38.265716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:42.111605 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:47.409021 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:56.191480 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:00.707844 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:17:01.549301 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:10.272074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:17:10.432659 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:15.679642 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:23:14.279141 3.000558 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:23:21.284846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:29.286802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:45.289824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:24:17.295610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:21.302831 3.000773 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:30:28.308714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:36.310765 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:52.313529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:31:24.319779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:28.327273 2.999868 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:37:35.332846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:43.334912 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:59.337213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:38:31.343465 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:35.351151 2.999968 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:44:42.356934 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:50.358622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:06.361226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:38.367573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:47:27.564738 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:47:27.565045 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:47:44.298644 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:03.140560 0.178756 tcp 10.0.2.16 49693 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:03.319425 0.209115 tcp 10.0.2.16 49694 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:03.529558 0.178283 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 361 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.708379 0.113116 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 485 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.708812 2.992020 tcp 10.0.2.16 49695 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:48:03.820701 0.097236 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 300 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.918441 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:12.699434 0.000000 tcp 10.0.2.16 49695 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:48:21.912591 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:24.707417 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:29.714274 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:34.721054 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:38.888102 0.176597 tcp 10.0.2.16 49696 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:39.065272 0.210165 tcp 10.0.2.16 49697 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:51:42.372735 3.002316 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:51:49.380865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:51:57.382230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:13.385189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:45.391502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:58:49.399588 2.999359 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:58:56.405238 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:04.406695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:20.409713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:52.415455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:05:56.422975 2.999866 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:06:03.429031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:11.430334 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:27.433088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:59.439494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:03.447031 3.000365 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:13:10.452531 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:18.454167 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:34.457368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:14:06.463191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:18:51.513599 0.000135 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:18:51.513929 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:07.906869 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:24.205220 0.179754 tcp 10.0.2.16 49698 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:24.385455 0.204258 tcp 10.0.2.16 49699 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:24.590754 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:42.206438 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:57.820746 0.178003 tcp 10.0.2.16 49700 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:57.999133 0.204763 tcp 10.0.2.16 49701 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:58.204915 0.113243 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.317259 0.173679 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 332 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.317840 3.005668 tcp 10.0.2.16 49702 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:19:58.491644 0.098825 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 379 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.591154 0.172255 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 536 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:01.764336 0.179093 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:04.939144 0.520119 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1223 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:05.459909 0.292577 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1310 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:05.753080 0.333501 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1411 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:06.085531 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:07.322307 0.000000 tcp 10.0.2.16 49702 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:20:10.470977 3.000123 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:20:12.700610 0.172012 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 374 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:15.874989 0.521250 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:16.396841 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:17.477011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:19.319978 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:24.326744 4.450813 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1880 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:25.267997 0.179505 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 526 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:25.477973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:28.776873 0.294117 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:29.071604 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:29.333928 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:37.435679 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:41.481145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:42.202010 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:20:44.736607 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:52.327173 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:00.378546 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:05.415914 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:12.816855 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:13.487153 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:21:20.687865 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:25.204475 0.000129 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:21:26.016927 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:34.998947 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:42.699940 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:49.910084 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:27:17.494900 2.999792 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:27:24.500842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:32.502373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:48.505523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:28:20.511092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:24.519044 2.999897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:34:31.525065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:39.525923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:55.529305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:35:27.535506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:41:31.542807 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:41:38.549210 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:41:46.550005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:02.553685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:34.559409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:48:38.566652 3.000728 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:48:45.572693 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:48:53.574540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:09.576862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:41.583596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:52:04.309004 0.000080 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:52:04.309194 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:20.081090 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:35.948496 0.178902 tcp 10.0.2.16 49703 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:52:36.127649 0.203979 tcp 10.0.2.16 49704 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:52:36.332584 0.171921 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:52:36.505220 0.112760 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 792 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:52:36.505812 2.993266 tcp 10.0.2.16 49705 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:52:36.617139 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:45.507487 0.000000 tcp 10.0.2.16 49705 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:52:55.512181 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:57.505242 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:02.512405 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:07.519646 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:13.440480 0.181203 tcp 10.0.2.16 49706 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:53:13.621504 0.210005 tcp 10.0.2.16 49707 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:53:13.832533 0.097425 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 282 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:53:13.930870 3.001986 tcp 10.0.2.16 49708 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:53:22.931601 0.000000 tcp 10.0.2.16 49708 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:53:34.929188 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:39.935844 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:44.943888 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:55:45.590348 3.001122 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:55:52.596701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:00.598202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:16.601068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:48.607197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:02:52.615292 3.000029 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:02:59.620444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:07.622443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:23.624993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:55.631156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:09:59.636942 3.001938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:10:06.644968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:14.646084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:30.648747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:11:02.655527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:06.663371 2.999094 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:17:13.668485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:21.669973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:37.673275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:18:09.679143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:23:28.317946 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:23:28.318271 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:23:44.049903 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:01.019673 0.182559 tcp 10.0.2.16 49709 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:01.201896 0.207370 tcp 10.0.2.16 49710 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:01.410241 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:13.687069 2.999904 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:24:19.351405 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:20.692812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:28.693788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:36.807720 0.177739 tcp 10.0.2.16 49711 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:36.985756 0.206158 tcp 10.0.2.16 49712 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:37.192963 0.173636 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.367403 0.113638 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 566 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.367973 2.992783 tcp 10.0.2.16 49713 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:24:37.480180 0.097138 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 301 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.577986 0.176766 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:40.751402 0.173557 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 501 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:43.926337 0.339017 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.264416 0.292296 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1288 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.557215 0.522385 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1379 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.697130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:45.080152 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:46.359635 0.000000 tcp 10.0.2.16 49713 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:24:52.658998 0.176471 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:55.833466 2.533852 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1218 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:56.355520 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:03.374306 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:03.624153 0.171818 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 386 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:06.799146 0.339086 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:07.137390 0.295221 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1429 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:07.433216 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 302 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:08.381460 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:15.701546 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 314 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:16.702796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:25:20.708832 0.000161 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:25:23.633132 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:30.412777 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:39.115627 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:46.776553 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:54.797918 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 306 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:00.426513 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:05.203050 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:26:09.068441 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:17.600998 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:26.072795 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:34.334632 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:31:20.710668 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:31:27.716834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:35.717787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:51.721119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:32:23.726937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:27.734979 2.999379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:38:34.740835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:42.741865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:58.744745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:39:30.751067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:45:34.756919 3.001601 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:45:41.764392 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:45:49.766273 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:05.768988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:37.775155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:52:41.782303 3.000227 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:52:48.788460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:52:56.789601 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:12.792658 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:44.799082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:57:02.383610 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:57:02.383920 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:18.145538 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:35.274934 0.178179 tcp 10.0.2.16 49714 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:57:35.453598 0.207229 tcp 10.0.2.16 49715 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:57:35.661824 0.178981 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:57:35.841442 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:35.842015 3.003341 tcp 10.0.2.16 49716 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:57:44.844247 0.000000 tcp 10.0.2.16 49716 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:57:52.094944 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:56.841513 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:01.848603 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:06.856248 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:10.213056 0.177430 tcp 10.0.2.16 49717 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:58:10.391002 0.203595 tcp 10.0.2.16 49718 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:58:10.595647 0.099834 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:58:10.696085 0.118320 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:59:48.804806 3.001968 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:59:55.812369 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:03.813773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:19.816713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:51.823053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:06:55.831137 2.999096 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:07:02.836232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:10.837966 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:26.840559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:58.847056 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:02.854409 2.999947 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:14:09.860599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:17.861532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:33.864563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:15:05.871471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:09.879036 2.999812 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:21:16.884282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:24.885998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:40.888607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:22:12.894892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:16.900237 3.002472 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:28:23.908295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:26.241591 0.000198 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:28:26.241952 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:28:31.909802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:43.426170 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:28:47.912548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:01.406586 0.177434 tcp 10.0.2.16 49719 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:01.584559 0.205699 tcp 10.0.2.16 49720 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:01.791501 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:18.356670 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:19.918996 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:35.684146 0.176893 tcp 10.0.2.16 49721 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:35.861596 0.208494 tcp 10.0.2.16 49722 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:36.070656 0.177689 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.249019 0.113843 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.249582 2.997223 tcp 10.0.2.16 49723 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 16:29:36.362248 0.096641 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 219 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.459826 0.174377 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:39.637257 0.180209 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 597 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:42.821701 0.338150 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.159603 0.293174 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.453282 0.535701 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1314 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.989579 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:45.245279 0.000000 tcp 10.0.2.16 49723 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 16:29:50.312564 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:55.670194 0.172874 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:57.242749 2.135417 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1142 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:59.378745 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:02.250148 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:04.462751 0.179271 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:07.257455 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:07.638060 0.339730 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1730 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:07.976960 0.293843 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1438 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:08.271638 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:13.886266 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:18.703153 0.000195 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:30:20.866658 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:28.928587 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:34.906478 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:40.174282 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:45.461983 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:54.154774 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:01.394993 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:06.201696 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:31:07.383682 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:14.954573 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:21.333240 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:35:23.926227 3.000416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 16:35:30.932428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:35:38.933734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:35:54.937033 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:36:26.942825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:42:30.950778 2.999328 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:42:37.955870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:42:45.957445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:01.961048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:33.967070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:37.974645 2.999854 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:49:44.980330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:52.981770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:08.984925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:40.990646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:56:44.998361 3.000289 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:56:52.003850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:00.005873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:16.008933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:48.016147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:01:35.672324 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:01:35.672645 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:01:52.606887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:10.115933 0.177231 tcp 10.0.2.16 49724 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:10.293662 0.215341 tcp 10.0.2.16 49725 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:10.510029 0.176462 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:02:10.687169 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:10.687757 2.998906 tcp 10.0.2.16 49726 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:02:19.685529 0.000000 tcp 10.0.2.16 49726 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:02:28.227807 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:31.682975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:36.689774 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:41.696910 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:44.873536 0.177478 tcp 10.0.2.16 49727 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:45.051430 0.210656 tcp 10.0.2.16 49728 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:45.263157 0.097446 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:02:45.361149 0.126326 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 625 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:03:52.022810 3.000647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 17:03:59.028127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:07.029755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:23.032311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:55.038362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:10:59.046619 2.999675 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:11:06.052001 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:14.053629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:30.056466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:12:02.062359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:06.070017 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:18:13.075944 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:21.077416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:37.080459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:19:09.086452 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:13.094014 3.000051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:25:20.099718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:28.101198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:44.104285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:26:16.110485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:20.117722 3.000298 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:32:27.123647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:35.125395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:46.752255 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:32:46.752546 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:32:51.128183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:33:04.027581 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:22.668672 0.177859 tcp 10.0.2.16 49729 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:22.846783 0.207085 tcp 10.0.2.16 49730 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:23.054960 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:23.134397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:33:40.069176 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:55.172780 0.176206 tcp 10.0.2.16 49731 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:55.349303 0.202854 tcp 10.0.2.16 49732 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:55.553114 0.175151 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.728891 0.154177 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 724 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.729465 3.006166 tcp 10.0.2.16 49733 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:33:55.882114 0.096944 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.979792 0.173053 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:59.156659 0.176999 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 449 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:02.330860 0.466468 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1606 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:02.796880 0.523429 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:03.320860 0.298322 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1304 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:03.619757 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 298 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:04.734390 0.000000 tcp 10.0.2.16 49733 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:34:10.503479 0.187279 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 505 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:16.731744 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:21.739156 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:26.745749 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:39:27.141889 3.000403 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 17:39:34.147610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:42.149263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:58.152610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:40:30.158357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:46:34.166308 2.999974 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:46:41.171904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:46:49.172949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:05.176352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:37.182181 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:53:41.189856 3.000090 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:53:48.195901 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:53:56.197658 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:12.200656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:44.206216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:00:48.214168 3.000526 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:00:55.220222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:03.222155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:19.224338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:51.230611 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:04:35.677096 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:04:35.677437 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:04:54.233999 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:10.742112 0.176652 tcp 10.0.2.16 49734 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:10.919131 0.203201 tcp 10.0.2.16 49735 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:11.123372 0.164651 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 596 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:11.287114 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:11.288296 3.004066 tcp 10.0.2.16 49736 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:05:20.290503 0.000000 tcp 10.0.2.16 49736 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:05:26.930530 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:32.288519 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:37.295765 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:42.302504 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:43.256138 0.186629 tcp 10.0.2.16 49737 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:43.443414 0.220748 tcp 10.0.2.16 49738 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:43.665293 0.138896 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:43.804815 0.180150 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 258 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:43.985614 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:06:01.570284 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:06:17.295518 0.177826 tcp 10.0.2.16 49739 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:06:17.473731 0.210273 tcp 10.0.2.16 49740 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:07:55.297906 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:08:02.304002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:10.305270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:26.308784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:58.314711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:02.321610 3.000388 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:15:09.327875 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:17.329319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:33.332617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:16:05.338154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:09.345856 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:22:16.352039 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:24.353350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:40.356326 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:23:12.362493 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:16.370184 3.000020 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:29:23.376028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:31.377299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:47.380363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:30:19.386562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:23.393652 3.000361 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:36:27.055725 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:36:27.056068 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:36:30.399728 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:38.401239 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:45.892801 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:36:54.403935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:02.651082 0.177172 tcp 10.0.2.16 49741 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:37:02.828595 0.213236 tcp 10.0.2.16 49742 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:37:03.042386 4.759980 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2044 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.166615 3.738724 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.166990 2.994056 tcp 10.0.2.16 49743 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:37:03.264322 4.163837 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.440185 0.174124 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 407 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:07.801749 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:12.160017 0.000000 tcp 10.0.2.16 49743 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:37:14.142554 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:20.136900 0.173617 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 461 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:23.306020 0.523918 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1086 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:23.830333 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:24.166981 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:26.410425 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:29.174226 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:31.297274 0.176339 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:34.181798 0.667246 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1798 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:34.848228 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:43.655101 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:48.261272 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:37:51.396564 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:59.748536 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:08.060672 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:14.399436 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:21.029480 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:29.441182 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:34.257753 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:38:35.169555 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:43.400865 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:51.973350 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:58.132660 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:39:03.280345 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:43:30.417529 3.000533 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:43:37.423739 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:43:45.425260 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:01.428410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:33.434162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:50:37.442207 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:50:44.447547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:50:52.449117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:08.452442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:40.458456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:57:44.465635 3.000436 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:57:51.471782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:57:59.472947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:15.476151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:47.482133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:04:51.489382 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:04:58.495789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:06.497014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:22.500342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:54.505776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:09:35.514420 0.000147 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:09:35.514727 0.179988 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 378 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:09:35.695429 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:09:35.696159 3.002088 tcp 10.0.2.16 49744 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:09:44.706867 0.000000 tcp 10.0.2.16 49744 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:09:52.037983 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:09:56.705173 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:01.711414 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:06.719073 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:07.534699 0.176825 tcp 10.0.2.16 49745 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:07.712004 0.207383 tcp 10.0.2.16 49746 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:07.920340 0.119844 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:10:08.039692 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:25.856760 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:43.994852 0.176844 tcp 10.0.2.16 49747 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:44.171947 0.204605 tcp 10.0.2.16 49748 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:11:58.514649 2.999108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:12:05.519272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:13.520945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:29.524456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:13:01.530174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:05.537376 3.000779 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:19:12.543705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:20.544837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:36.547915 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:20:08.553723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:12.561656 2.999928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:26:19.567350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:27.569362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:43.572133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:27:15.578191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:19.585394 2.999862 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:33:26.591825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:34.593193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:50.596431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:34:22.601781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:26.607999 3.001400 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:40:33.615696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:41.617159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:57.619764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:07.444171 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:41:07.444448 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:22.646361 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:29.626065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:40.897384 0.177440 tcp 10.0.2.16 49749 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:41:41.075153 0.209708 tcp 10.0.2.16 49750 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:41:41.285873 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:59.899584 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:17.527038 0.179793 tcp 10.0.2.16 49751 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:42:17.707020 0.209027 tcp 10.0.2.16 49752 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:42:17.917050 0.173947 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:18.091665 0.120144 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 769 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:18.092216 2.987918 tcp 10.0.2.16 49753 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:42:18.212074 0.176408 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 662 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:21.390767 0.174907 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 535 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:24.564773 0.354853 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:24.919303 0.517241 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1258 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:25.437057 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:27.078727 0.000000 tcp 10.0.2.16 49753 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:42:33.758128 0.292525 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1372 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:34.051126 0.174730 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:39.086384 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:44.093531 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:49.100752 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:47:33.633147 3.000186 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:47:40.639134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:47:48.640788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:04.644150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:36.649802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:54:40.657122 3.000368 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:54:47.662961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:54:55.664884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:11.667641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:43.674091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:01:47.681723 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:01:54.687055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:02.688590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:18.691817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:50.698134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:08:54.705337 3.000251 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:09:01.711411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:09.713155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:25.716076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:57.721892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:12:47.506619 0.000148 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:12:47.506925 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:04.631109 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:20.078651 0.459123 tcp 10.0.2.16 49754 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:20.538250 0.471812 tcp 10.0.2.16 49755 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:21.010624 0.132792 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 503 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:21.142709 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:21.143839 2.994677 tcp 10.0.2.16 49756 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:13:30.147701 0.000000 tcp 10.0.2.16 49756 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:13:36.626384 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:42.155178 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:47.161787 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:52.168854 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:53.883927 0.882699 tcp 10.0.2.16 49757 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:54.767097 0.953184 tcp 10.0.2.16 49758 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:55.721274 0.661239 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:56.383096 0.547134 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:56.930832 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:14:14.260711 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:14:30.486395 0.263801 tcp 10.0.2.16 49759 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:14:30.750715 0.340180 tcp 10.0.2.16 49760 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:16:01.729154 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:16:08.735300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:16.736497 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:32.739614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:17:04.745885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:08.753363 3.000391 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:23:15.758809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:23.760693 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:39.764040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:24:11.769451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:15.777062 3.000308 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:30:22.783422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:30.784593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:46.787687 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:31:18.793923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:22.800924 3.000402 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:37:29.807444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:37.808420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:53.811824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:38:25.817850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:29.826572 2.998488 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:44:36.831026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:44.832709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:51.782741 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:44:51.783057 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:00.835334 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:08.757510 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:24.802893 0.179063 tcp 10.0.2.16 49761 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:45:24.982387 0.212058 tcp 10.0.2.16 49762 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:45:25.195521 4.712374 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2016 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.309756 3.967340 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.310337 3.004712 tcp 10.0.2.16 49763 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:45:25.483834 4.085088 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.581554 0.176741 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:29.907658 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:32.841804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:34.313676 0.000000 tcp 10.0.2.16 49763 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:45:38.790133 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:46.311732 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:47.713313 0.178019 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:50.888038 0.519342 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1130 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:51.318452 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:51.407941 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:56.325231 4.664114 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1709 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:57.477270 0.175827 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:46:00.989664 0.294770 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1217 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:46:01.284867 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:06.259364 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:46:09.604602 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:17.476210 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:25.136967 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:32.537602 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:39.727691 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:45.837014 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:50.763445 0.000111 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:46:53.728045 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:01.609066 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:08.299043 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:15.128885 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:20.907459 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:51:36.849214 2.999746 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:51:43.854979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:51:51.856265 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:07.859829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:39.865560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:58:43.872728 3.000135 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:58:50.879443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:58:58.880551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:14.883776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:46.889476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:05:50.897530 2.999774 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:05:57.903097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:05.904210 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:21.907686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:53.913637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:12:57.921326 3.000147 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:13:04.926648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:12.928403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:28.931066 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:14:00.937740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:17:45.761418 0.000148 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:17:45.761735 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:01.644070 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:20.074930 0.181867 tcp 10.0.2.16 49764 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:20.257338 0.209033 tcp 10.0.2.16 49765 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:20.467391 0.178641 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:18:20.646721 0.122744 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:18:20.647346 2.997744 tcp 10.0.2.16 49766 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:18:20.768974 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:29.643902 0.000000 tcp 10.0.2.16 49766 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:18:38.356752 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:41.641101 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:46.648735 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:51.655867 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:53.941274 0.242521 tcp 10.0.2.16 49767 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:54.184302 0.272785 tcp 10.0.2.16 49768 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:54.458050 0.106394 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 275 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:20:04.944717 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:20:11.950509 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:19.952274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:35.954992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:21:07.961224 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:11.969186 3.000339 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:27:18.975114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:26.976686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:42.979267 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:28:14.985798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:18.993171 3.000201 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:34:25.999183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:34.000772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:50.003304 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:35:22.009000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:26.017153 3.000197 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:41:33.022822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:41.024696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:57.027562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:42:29.033478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:33.041589 3.000190 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:48:40.046998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:48.048191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:59.084400 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:48:59.084703 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:04.051071 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:17.029795 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:34.568432 0.172443 tcp 10.0.2.16 49769 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:49:34.740775 0.203763 tcp 10.0.2.16 49770 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:49:34.945102 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:36.057005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:51.229238 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:09.036346 0.172163 tcp 10.0.2.16 49771 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:50:09.209098 0.206824 tcp 10.0.2.16 49772 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:50:09.416462 0.172394 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.589537 0.115356 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.590142 2.989788 tcp 10.0.2.16 49773 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:50:09.704338 0.095306 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 392 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.800406 0.171626 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 540 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:12.970605 0.174547 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 576 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.144874 0.344776 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.488816 0.288501 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.777952 0.518548 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1255 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:17.297083 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:18.578012 0.000000 tcp 10.0.2.16 49773 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:50:25.248481 0.176502 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:30.585799 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:35.592742 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:40.600328 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:55:40.065123 2.999637 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:55:47.071914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:55:55.073351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:11.075812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:43.081522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:02:47.089056 2.999792 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:02:54.094354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:02.096411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:18.099508 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:50.105356 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:09:54.113192 3.000110 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:10:01.118898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:09.119840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:25.123456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:57.128932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:01.137021 3.000084 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:17:08.143062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:16.144218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:32.146866 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:18:04.152804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:20:49.371433 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:20:49.371616 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:06.094642 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:24.005501 0.172596 tcp 10.0.2.16 49774 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:24.178381 0.204613 tcp 10.0.2.16 49775 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:24.384013 0.121241 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 744 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:24.504537 0.097082 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:24.505640 2.999463 tcp 10.0.2.16 49776 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:21:24.602187 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:33.504328 0.000000 tcp 10.0.2.16 49776 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:21:40.524303 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:45.502105 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:50.509205 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:55.515913 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:56.409093 0.172708 tcp 10.0.2.16 49777 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:56.582218 0.204368 tcp 10.0.2.16 49778 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:56.787617 0.169367 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 283 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:56.957567 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:22:13.511585 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:22:28.674586 0.172476 tcp 10.0.2.16 49779 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:22:28.847554 0.204550 tcp 10.0.2.16 49780 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:24:08.158973 3.001517 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:24:15.166756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:23.168197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:39.171434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:25:11.177083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:15.184666 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:31:22.190745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:30.192098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:46.194730 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:32:18.200843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:22.208837 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:38:29.214584 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:37.215992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:53.218874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:39:25.225309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:29.232758 3.000087 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:45:36.238428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:44.240149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:00.243498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:32.249085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:36.256987 3.000196 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:52:42.051025 0.000298 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:52:42.051476 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:52:43.262423 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:51.264014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:57.272887 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:07.267162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:15.443622 1.933967 tcp 10.0.2.16 49781 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:53:15.617606 0.200167 tcp 10.0.2.16 49782 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:53:15.818756 3.888624 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2474 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:15.929167 4.572382 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:15.930233 3.003156 tcp 10.0.2.16 49783 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:16.025324 4.191538 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1513 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:16.195955 0.180185 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:20.502062 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:24.931979 0.000000 tcp 10.0.2.16 49783 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:27.797056 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:35.738238 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:36.929988 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:39.273763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:41.937188 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:44.009763 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:46.944093 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:49.988310 0.177488 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 545 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:53.163004 0.523589 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:53.687381 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:53.687981 3.009917 tcp 10.0.2.16 49784 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:57.759520 0.000076 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:53:59.892780 0.170834 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:02.706303 0.000000 tcp 10.0.2.16 49784 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:54:03.067210 0.340547 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:03.407055 0.285514 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1216 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:03.693211 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:12.320654 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:14.704799 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:19.711567 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:20.252450 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:24.719190 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:27.382069 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:33.190561 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:40.181054 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:44.757112 0.000122 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:54:47.131127 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:54.441595 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:02.913762 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:10.133732 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:17.474715 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:24.694796 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:29.261184 0.000117 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:59:43.280875 2.999470 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:59:50.286372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:59:58.287851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:14.291042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:46.297377 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:06:50.304569 2.999726 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:06:57.309989 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:05.312109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:21.315433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:53.321100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:13:57.326677 3.001776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:14:04.334348 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:12.336012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:28.339125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:15:00.344744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:04.352415 3.000228 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:21:11.358775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:19.359708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:35.362661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:22:07.368697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:25:48.366872 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:25:48.367214 0.174559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:25:48.542419 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:25:48.543114 2.997654 tcp 10.0.2.16 49785 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:25:57.539617 0.000000 tcp 10.0.2.16 49785 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:26:06.793336 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:09.547431 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:14.554074 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:19.561461 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:22.410007 0.173726 tcp 10.0.2.16 49786 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:22.584276 0.226066 tcp 10.0.2.16 49787 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:22.811418 0.125714 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 422 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:26:22.936530 0.095089 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:26:23.032180 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:41.884151 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:59.180516 0.171299 tcp 10.0.2.16 49788 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:59.352182 0.212805 tcp 10.0.2.16 49789 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:28:11.376274 3.000497 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 23:28:18.382143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:26.384288 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:42.386812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:29:14.392552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:18.400778 2.999460 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:35:25.406014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:33.407425 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:49.411142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:36:21.417006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:25.424450 3.000249 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:42:32.430285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:40.431632 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:56.434688 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:43:28.440970 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:49:32.448358 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:49:39.454312 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:49:47.455605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:03.458985 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:35.464572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:56:39.472638 2.999838 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:56:46.478047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:56:54.479380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:02.190878 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:57:02.191284 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:10.483049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:17.853467 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:36.434550 0.174523 tcp 10.0.2.16 49790 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:57:36.609460 0.272211 tcp 10.0.2.16 49791 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:57:36.882645 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:42.488362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:53.013930 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:11.653212 0.181254 tcp 10.0.2.16 49792 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:58:11.834861 0.208284 tcp 10.0.2.16 49793 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:58:12.044142 0.179589 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.224240 0.118728 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.224590 3.001132 tcp 10.0.2.16 49794 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:58:12.342425 0.095871 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.438984 0.171333 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 440 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:15.606425 0.173710 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 518 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:18.781195 0.335873 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.116256 0.289424 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1341 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.406252 0.511188 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1167 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.917999 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:21.223998 0.000000 tcp 10.0.2.16 49794 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:58:28.474652 0.171182 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:31.649852 1.572533 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:32.163073 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:38.229174 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:39.541019 0.173531 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:42.715296 0.338698 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1594 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:43.053267 0.297772 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:43.236355 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:43.351716 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:51.718540 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:56.254543 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:58:56.845274 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:03.275710 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:09.403745 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:16.093397 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:21.751562 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:28.721537 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:36.923651 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:41.760145 0.000132 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:59:45.295589 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:50.332563 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:57.232787 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:03:46.496282 3.000376 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 00:03:53.502568 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:01.504106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:17.506325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:49.512228 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:10:53.520144 3.000271 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:11:00.525720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:08.527333 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:24.530877 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:56.537211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:00.544173 3.000118 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:18:07.550112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:15.551443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:31.554357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:19:03.560342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:07.568425 2.999536 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:25:14.574097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:22.575563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:38.578123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:26:10.584346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:30:24.419980 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:30:24.420327 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:40.633494 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:56.330050 0.177755 tcp 10.0.2.16 49795 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:30:56.508101 0.207707 tcp 10.0.2.16 49796 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:30:56.716889 0.182828 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:30:56.900398 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:56.901019 2.999490 tcp 10.0.2.16 49797 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 00:31:05.899376 0.000000 tcp 10.0.2.16 49797 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 00:31:12.749219 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:17.907059 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:22.913968 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:27.921273 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:28.173140 0.177010 tcp 10.0.2.16 49798 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:31:28.350421 0.208093 tcp 10.0.2.16 49799 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:31:28.559533 0.102060 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:31:28.662257 0.116156 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 703 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:32:14.592116 2.999704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 00:32:21.597862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:29.599856 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:45.602378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:33:17.608542 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:21.616472 3.000106 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:39:28.622197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:36.623563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:52.626604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:40:24.632463 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:28.641464 2.998633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:46:35.645725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:43.647842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:59.650261 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:47:31.656101 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:53:35.664234 2.999724 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:53:42.670037 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:53:50.671418 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:06.674597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:38.680782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:00:42.688254 3.000008 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:00:49.693706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:00:57.695325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:13.698461 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:31.394083 0.000186 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:01:31.394462 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:01:45.704080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:49.980770 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:05.717959 1.627135 tcp 10.0.2.16 49800 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:07.345616 1.784764 tcp 10.0.2.16 49801 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:09.131429 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:27.203945 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:45.893532 3.961126 tcp 10.0.2.16 49802 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:47.567623 1.785365 tcp 10.0.2.16 49803 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:49.354007 1.016393 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 391 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:50.371129 0.907127 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 692 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:50.371812 2.999765 tcp 10.0.2.16 49804 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:02:51.277616 0.888962 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:52.177496 0.942998 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:56.115606 0.958073 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:59.370324 0.000000 tcp 10.0.2.16 49804 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:00.072445 2.895302 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1373 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:02.968340 2.695172 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1442 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:05.662759 2.643349 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1223 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:08.306744 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:11.377644 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:16.265211 0.963976 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:16.385104 4.823596 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 4 754 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:21.391787 1.804845 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 4 783 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:23.197349 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:30.094725 0.960271 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:34.050388 2.755452 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:34.760767 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:03:36.805521 2.671930 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1138 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:36.806410 2.992325 tcp 10.0.2.16 49805 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:39.478292 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:45.807532 0.000000 tcp 10.0.2.16 49805 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:45.867079 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:54.329355 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:57.814434 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:00.307892 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:02.821763 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:06.948071 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:07.829018 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:12.845795 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:17.763044 0.000285 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:04:18.654642 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:27.397189 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:32.768504 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:41.166781 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:47.856580 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:53.424142 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:07:49.712067 3.000110 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:07:56.717931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:04.719578 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:20.722170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:52.728585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:14:56.735703 3.000462 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:15:03.741766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:11.742948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:27.746351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:59.752032 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:03.760122 3.000119 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:22:10.765512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:18.766853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:34.770057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:23:06.776180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:10.783789 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:29:17.789919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:25.791488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:41.793830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:30:13.800585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:35:27.181390 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:35:27.181721 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:35:43.384408 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:01.885066 0.198117 tcp 10.0.2.16 49806 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:02.083776 0.207182 tcp 10.0.2.16 49807 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:02.292049 0.176845 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 401 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:02.469553 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:02.470166 2.995399 tcp 10.0.2.16 49808 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:36:11.464712 0.000000 tcp 10.0.2.16 49808 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:36:17.807976 3.000181 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:36:18.254597 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:23.462345 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:24.813337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:36:28.468875 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:32.815525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:36:33.476655 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:36.181381 0.187693 tcp 10.0.2.16 49809 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:36.369337 0.212172 tcp 10.0.2.16 49810 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:36.582060 0.124325 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 466 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:36.706712 0.097096 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 320 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:48.817920 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:37:20.824408 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:24.831714 3.000156 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:43:31.837586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:39.839331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:55.841903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:44:27.847820 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:50:31.855742 3.000395 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:50:38.861819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:50:46.862757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:02.865920 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:34.872225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:57:38.877533 3.002177 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:57:45.885243 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:57:53.886761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:09.889875 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:41.896324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:04:45.903761 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:04:52.909630 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:00.910768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:16.914363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:48.919689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:06:50.989654 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:06:50.989986 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:09.906853 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:27.926836 0.171555 tcp 10.0.2.16 49811 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:07:28.098740 0.207758 tcp 10.0.2.16 49812 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:07:28.307551 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:45.517994 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:01.292580 0.171809 tcp 10.0.2.16 49813 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:08:01.464852 0.205137 tcp 10.0.2.16 49814 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:08:01.671117 0.170588 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:01.842322 0.123916 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 654 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:01.842883 3.002798 tcp 10.0.2.16 49815 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:08:01.965560 0.096089 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 390 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:02.062335 0.173352 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:05.236395 0.176571 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:08.410836 0.383582 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:08.793713 0.525119 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:09.319352 0.384889 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1256 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:09.704783 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:10.843706 0.000000 tcp 10.0.2.16 49815 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:08:15.595235 0.345977 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:18.946309 3.895462 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:19.776083 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:26.656818 0.445580 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 452 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:27.848692 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:30.102598 0.366368 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1530 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:30.468276 0.285739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1478 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:30.754472 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:32.855663 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:38.053097 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:42.759735 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:08:46.135184 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:53.885962 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:02.408395 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:09.918956 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:15.537759 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:22.867816 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:27.754821 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:09:30.318717 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:37.619018 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:43.387536 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:51.108769 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:11:52.927685 3.000262 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 02:11:59.933776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:07.934551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:23.937753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:55.943906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:18:59.951627 2.999987 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:19:06.957805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:14.958986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:30.962319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:20:02.968353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:06.975762 3.000060 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:26:13.981035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:21.982992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:37.985902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:27:09.991642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:13.999683 2.999645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:33:21.005263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:29.007414 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:45.010069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:34:17.015795 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:10.688887 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:40:10.689172 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:21.023355 2.999944 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:40:28.028993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:29.681671 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:36.031005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:48.132556 0.172274 tcp 10.0.2.16 49816 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:40:48.305356 0.204027 tcp 10.0.2.16 49817 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:40:48.510402 0.218747 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 349 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.729776 0.123778 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 673 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.730352 3.003187 tcp 10.0.2.16 49818 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:40:48.852946 0.097587 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.951078 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:52.034091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:57.732006 0.000000 tcp 10.0.2.16 49818 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:41:04.211632 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:09.729407 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:14.737000 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:19.744293 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:19.746733 0.171367 tcp 10.0.2.16 49819 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:41:19.918372 0.225327 tcp 10.0.2.16 49820 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:41:24.040485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:28.047642 2.999881 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:47:35.053695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:43.054676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:59.057830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:48:31.063729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:54:35.071901 3.000659 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:54:42.078664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:54:50.079068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:06.081480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:38.087841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:01:42.093666 3.001961 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:01:49.101515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:01:57.102810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:13.105516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:45.111595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:08:49.119675 3.000052 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:08:56.125024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:04.126986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:20.129565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:52.136109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:11:45.749985 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:11:45.750280 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:01.572262 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:19.011773 0.172866 tcp 10.0.2.16 49821 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:19.184926 0.210999 tcp 10.0.2.16 49822 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:19.396939 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:37.513416 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:56.422680 0.174868 tcp 10.0.2.16 49823 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:56.598107 0.208650 tcp 10.0.2.16 49824 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:56.807763 0.131388 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:56.938595 0.269314 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:56.939774 3.006005 tcp 10.0.2.16 49825 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:12:57.208504 0.095415 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 268 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:57.304740 0.266612 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:00.566709 0.258559 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 421 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:03.821300 0.384989 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1618 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:04.205495 0.286144 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:04.492171 0.795997 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:05.288748 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:05.944805 0.000000 tcp 10.0.2.16 49825 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:13:13.916019 0.264694 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:17.180556 0.803350 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 970 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:17.942163 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:17.984499 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:22.949216 4.991079 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1968 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:24.281470 0.272527 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 636 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:27.939486 0.285546 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:27.955873 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:28.225577 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:37.189202 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:41.755656 0.000141 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:13:42.657023 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:51.279690 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:58.960731 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 308 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:04.959776 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:11.358433 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:19.930872 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:24.757944 0.000156 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:14:26.590267 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:33.690920 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:40.901317 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 306 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:47.860945 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:15:56.143585 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 03:16:03.149268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:11.150447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:27.153534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:59.159826 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:03.165307 3.002491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:23:10.172817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:18.174336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:34.177763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:24:06.183537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:10.191897 2.999699 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:30:17.196740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:25.198421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:41.201444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:31:13.207396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:17.215121 3.000388 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:37:24.221365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:32.222871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:48.225618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:38:20.231420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:24.239035 3.000070 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:44:31.245179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:39.246380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:55.249179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:22.218706 0.000153 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:45:22.219031 0.260587 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 309 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:45:22.480296 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:22.481002 3.001899 tcp 10.0.2.16 49826 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:45:27.255940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:31.481514 0.000000 tcp 10.0.2.16 49826 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:45:41.135620 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:43.478834 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:48.486557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:53.493835 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:58.114332 0.172501 tcp 10.0.2.16 49827 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:45:58.287473 0.206587 tcp 10.0.2.16 49828 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:45:58.495028 0.116824 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 647 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:45:58.611016 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:58.612434 3.002225 tcp 10.0.2.16 49829 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:46:07.613259 0.000000 tcp 10.0.2.16 49829 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:46:14.053450 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:19.611058 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:24.618466 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:29.625661 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:32.721612 0.177125 tcp 10.0.2.16 49830 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:46:32.899339 0.203887 tcp 10.0.2.16 49831 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:46:33.104297 0.100187 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 308 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:51:31.262849 3.000711 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 03:51:38.269544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:51:46.270775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:02.273732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:34.279523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:58:38.287462 2.999431 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:58:45.293040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:58:53.294233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:09.297871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:41.303320 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:05:45.310586 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:05:52.317225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:00.318134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:16.321104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:48.327521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:12:52.334830 3.000245 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:12:59.340898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:07.342520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:23.345102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:55.351523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:16:42.021353 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:16:42.021685 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:16:57.713490 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:14.983669 0.175979 tcp 10.0.2.16 49832 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:15.159963 0.205383 tcp 10.0.2.16 49833 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:15.366318 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:30.570844 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:48.938811 0.173305 tcp 10.0.2.16 49834 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:49.112625 0.206093 tcp 10.0.2.16 49835 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:49.319774 0.273086 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.593529 0.115625 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.594147 2.998188 tcp 10.0.2.16 49836 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:17:49.708376 0.094995 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 325 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.804068 0.268051 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:53.074522 0.270597 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.348054 0.339588 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1674 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.687110 0.284783 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1131 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.972496 0.817838 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1149 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:57.790974 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:58.591065 0.000000 tcp 10.0.2.16 49836 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:18:04.487000 0.264010 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:07.754384 2.834547 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:08.540998 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:15.595807 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:17.148145 0.276578 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 475 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:20.422949 0.339857 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:20.602729 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:20.762165 0.286630 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1349 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:21.049458 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:27.452763 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:32.259928 0.000072 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:18:34.152122 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:40.852345 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:47.642002 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:53.049707 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:01.712289 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:09.453136 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:14.260124 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:19:15.571696 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:22.272191 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:28.430183 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:37.043040 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:59.359067 3.000354 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:20:06.365095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:14.366337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:30.369059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:21:02.375711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:06.382865 3.000130 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:27:13.388564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:21.390092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:37.392944 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:28:09.399560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:13.406982 3.000478 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:34:20.412522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:28.414447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:44.417125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:35:16.423041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:20.431559 2.999767 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:41:27.436980 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:35.438363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:51.441431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:42:23.447360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:27.455092 3.000237 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:48:34.460499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:42.462152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:58.465009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:30.471752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:59.503552 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:49:59.503900 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:15.786575 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:31.022820 0.174504 tcp 10.0.2.16 49837 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:50:31.197619 0.206545 tcp 10.0.2.16 49838 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:50:31.405160 0.265708 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 363 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:50:31.671752 0.114370 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 778 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:50:31.672351 3.000928 tcp 10.0.2.16 49839 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:50:31.785188 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:40.672487 0.000000 tcp 10.0.2.16 49839 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:50:47.992628 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:52.670081 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:57.676580 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:51:02.683783 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:51:06.701807 0.214152 tcp 10.0.2.16 49840 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:51:06.916350 0.207716 tcp 10.0.2.16 49841 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:51:07.125066 0.097284 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 317 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:55:34.478535 3.000525 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:55:41.484840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:55:49.486077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:05.489194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:37.495170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:02:41.503255 2.999587 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:02:48.508850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:02:56.509892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:12.513343 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:44.518882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:09:48.527023 3.000005 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:09:55.533030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:03.534625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:19.537282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:51.543127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:16:55.551109 2.999775 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:17:02.556761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:10.558272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:26.561337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:58.567145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:21:15.109681 0.000127 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:21:15.110013 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:21:32.695176 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:21:49.714407 0.181007 tcp 10.0.2.16 49842 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:21:49.895967 0.204002 tcp 10.0.2.16 49843 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:21:50.100955 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:05.502477 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:21.537451 0.197288 tcp 10.0.2.16 49844 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:22:21.735584 0.226587 tcp 10.0.2.16 49845 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:22:21.962743 0.264109 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.227718 0.116466 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 505 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.228325 3.002111 tcp 10.0.2.16 49846 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:22:22.343627 0.096945 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.441291 0.254984 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 597 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:25.691659 0.264438 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:28.955698 0.345295 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1331 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:29.300102 0.288954 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:29.589613 0.767334 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1091 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:30.357697 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:31.228828 0.000000 tcp 10.0.2.16 49846 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:22:35.886075 0.264292 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:39.150849 4.086200 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:39.923695 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:47.432936 0.262857 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:48.244340 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:50.707880 0.344520 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:51.051966 0.304195 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1276 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:51.356759 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:53.250860 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:56.495599 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:03.775792 0.374091 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:04.149883 0.000000 icmp 111.242.171.190 0x0303 -> 10.0.2.16 0xc840 URP 192 1 274 flow=Background 1970/01/04 05:23:08.753279 0.000061 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:23:09.373885 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:16.725119 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:23.935431 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:32.757860 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:38.676459 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:47.098552 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:51.754619 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:23:52.305607 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:59.395758 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:24:02.574687 3.000034 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:24:04.884065 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:24:09.581102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:17.581614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:33.584774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:25:05.591347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:09.598955 2.999796 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:31:16.604437 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:24.605798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:40.608648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:32:12.614891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:16.622926 2.999897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:38:23.628599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:31.630165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:47.632922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:39:19.638870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:23.646563 2.999955 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:45:30.652760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:38.653688 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:54.657303 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:46:26.662840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:52:30.670436 3.000037 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:52:37.676572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:52:45.678416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:01.680784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:33.687504 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:54:24.330344 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:54:24.330680 0.261479 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 317 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:54:24.592882 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:24.593577 3.001249 tcp 10.0.2.16 49847 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:54:33.592784 0.000000 tcp 10.0.2.16 49847 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:54:43.068266 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:45.590836 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:50.598072 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:55.604775 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:58.863927 0.170490 tcp 10.0.2.16 49848 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:54:59.034770 0.204037 tcp 10.0.2.16 49849 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:54:59.239840 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:16.465243 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:33.241415 0.173207 tcp 10.0.2.16 49850 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:55:33.415080 0.203102 tcp 10.0.2.16 49851 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:55:33.619136 0.098214 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:55:33.717973 0.123781 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 609 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:55:33.718526 2.995520 tcp 10.0.2.16 49852 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:55:42.712235 0.000000 tcp 10.0.2.16 49852 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:55:54.709975 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:59.716792 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:56:04.724409 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:59:37.694604 3.000140 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:59:44.700641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:59:52.702020 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:08.704862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:40.710985 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:06:44.718587 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:06:51.724727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:06:59.725455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:15.728827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:47.735109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:13:51.742221 2.999938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:13:58.748248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:06.749631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:22.752900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:54.759093 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:20:58.764426 3.002393 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:21:05.772107 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:13.773995 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:29.777201 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:22:01.782530 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:26:02.809462 0.000120 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:26:02.809811 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:17.971486 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:35.210439 0.182780 tcp 10.0.2.16 49853 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:26:35.393587 0.207702 tcp 10.0.2.16 49854 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:26:35.602378 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:53.902774 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:12.151367 0.172948 tcp 10.0.2.16 49855 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:27:12.324808 0.202911 tcp 10.0.2.16 49856 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:27:12.528747 0.264058 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 350 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:12.793521 0.113862 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:12.794165 2.999690 tcp 10.0.2.16 49857 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:12.906823 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:21.793168 0.000000 tcp 10.0.2.16 49857 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:29.604284 0.094739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:29.699834 0.259943 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 542 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:32.959288 0.266143 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 446 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:33.790658 3.572502 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1397 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:36.223755 0.338659 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1279 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:37.363543 0.283874 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1047 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:37.647920 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:38.797750 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:43.123650 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:43.804777 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:50.814572 0.267405 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:54.079923 0.806926 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1049 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:54.887613 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:54.888211 3.006662 tcp 10.0.2.16 49858 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:55.751317 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:28:00.298525 0.272515 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:03.573300 0.339514 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1731 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:03.893076 0.000000 tcp 10.0.2.16 49858 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:28:03.912499 0.284826 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1289 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:04.197936 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:05.788623 3.002254 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 06:28:10.873745 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:12.796205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:15.891386 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:19.466256 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:20.797346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:20.897954 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:25.354307 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:25.905532 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:31.924130 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:36.800848 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:37.561913 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:42.258356 0.000083 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:28:45.924179 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:54.266195 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:03.188650 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:08.806940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:29:11.290666 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:19.031408 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:23.758432 0.000117 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:29:24.759917 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:35:12.814224 3.000108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:35:19.820257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:27.822089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:43.824364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:36:15.830427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:19.838229 3.000498 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:42:26.843851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:34.845725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:50.848499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:43:22.854472 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:26.862197 3.000026 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:49:33.868247 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:41.869869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:57.872339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:50:29.878441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:56:33.885886 3.000433 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:56:40.892008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:56:48.893413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:04.896354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:36.902803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:59:51.807018 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:59:51.807395 0.267351 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 293 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:59:52.075514 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:59:52.076210 2.995175 tcp 10.0.2.16 49859 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:00:01.070240 0.000000 tcp 10.0.2.16 49859 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:00:07.509667 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:13.077465 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:18.084873 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 93 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:23.091847 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:24.818328 0.172569 tcp 10.0.2.16 49860 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:00:24.991191 0.209968 tcp 10.0.2.16 49861 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:00:25.202135 0.122557 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 762 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:00:25.323825 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:43.431482 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:00.257239 0.173815 tcp 10.0.2.16 49862 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:01:00.431588 0.210763 tcp 10.0.2.16 49863 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:01:00.644103 0.096950 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:01:00.741948 2.997694 tcp 10.0.2.16 49864 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:01:09.738411 0.000000 tcp 10.0.2.16 49864 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:01:21.745861 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:26.753181 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:31.760717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:03:40.909663 3.000608 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:03:47.916345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:03:55.917696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:11.920434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:43.926480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:10:47.934874 2.999196 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:10:54.940029 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:02.941190 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:18.944716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:50.950911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:17:54.958363 2.999519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:18:01.964323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:09.965174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:25.968584 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:57.974525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:01.981774 3.000397 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:25:08.987971 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:16.989079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:32.992654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:26:04.998695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:31:09.546345 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:31:09.546677 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:31:27.842499 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:31:44.491487 0.172527 tcp 10.0.2.16 49865 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:31:44.664475 0.228898 tcp 10.0.2.16 49866 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:31:44.894360 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:02.883379 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:09.004360 3.001490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:32:16.011930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:20.509192 0.172051 tcp 10.0.2.16 49867 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:32:20.681555 0.228188 tcp 10.0.2.16 49868 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:32:20.910729 0.280601 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.192062 0.124040 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 718 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.192678 3.000583 tcp 10.0.2.16 49869 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:32:21.315773 0.096649 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.413094 0.271587 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 522 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:24.013076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:24.685017 0.267495 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:27.949477 0.371314 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1788 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:28.320185 0.289695 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1215 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:28.610384 0.841793 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:29.452791 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:30.191937 0.000000 tcp 10.0.2.16 49869 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:32:38.364507 0.269697 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:40.016400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:42.189858 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:47.197217 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:52.203895 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:33:12.022116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:16.030291 3.000123 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:39:23.036484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:31.037207 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:47.040389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:40:19.046701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:23.054076 3.000272 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:46:30.059798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:38.061192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:54.064612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:47:26.071706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:53:30.079129 2.998982 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:53:37.084015 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:53:45.085256 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:01.088451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:33.094638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:00:37.102067 2.999576 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:00:44.107913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:00:52.109333 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:08.112235 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:40.118554 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:03:08.085870 0.000130 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:03:08.086192 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:23.537032 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:40.676511 0.197070 tcp 10.0.2.16 49870 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:03:40.873421 0.253335 tcp 10.0.2.16 49871 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:03:41.127872 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:58.297160 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:17.256714 0.197526 tcp 10.0.2.16 49872 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:17.454787 0.205722 tcp 10.0.2.16 49873 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:17.661535 0.104634 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 392 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:17.766844 0.123193 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 732 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:17.767486 2.991391 tcp 10.0.2.16 49874 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:04:17.889253 0.269819 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 207 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:18.159811 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:26.767808 0.000000 tcp 10.0.2.16 49874 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:04:36.011324 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:38.775655 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:43.782500 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:48.790040 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:52.237312 0.173684 tcp 10.0.2.16 49875 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:52.411549 0.213837 tcp 10.0.2.16 49876 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:07:44.126176 3.000091 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:07:51.131367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:07:59.133068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:15.136551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:47.142638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:14:51.149709 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:14:58.156067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:06.157499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:22.159824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:54.166311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:21:58.174099 2.999992 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:22:05.179392 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:13.181004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:29.184102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:23:01.190318 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:05.197394 3.000463 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:29:12.203387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:20.205099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:36.208678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:30:08.213842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:35:22.086118 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:35:22.086418 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:35:40.842919 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:35:57.541096 0.173631 tcp 10.0.2.16 49877 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:35:57.714981 0.216305 tcp 10.0.2.16 49878 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:35:57.932254 4.920296 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 479 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.031121 4.004323 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1979 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.031766 2.999798 tcp 10.0.2.16 49879 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:35:58.147415 4.704724 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.417835 0.270467 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:02.948435 0.193682 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 1098 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:03.142532 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:07.030300 0.000000 tcp 10.0.2.16 49879 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:36:09.744295 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:12.221607 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:36:15.241744 0.271712 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:18.516397 0.829493 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1140 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:19.037800 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:19.227755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:19.346517 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:24.045100 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:27.228740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:27.479619 0.277104 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:29.051592 2.338365 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1568 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:30.754667 0.344929 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1684 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:31.390600 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:39.437037 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:43.232351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:44.253257 0.000106 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:36:47.298434 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:54.458617 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:01.959444 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:09.520374 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:15.238116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:37:17.561418 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:23.870653 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:28.757705 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:37:31.361427 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:36.809486 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:42.447654 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:48.315803 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:43:19.246049 3.000039 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:43:26.251371 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:34.252992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:50.256174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:44:22.262411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:26.269943 2.999908 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:50:33.275243 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:41.276741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:57.280349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:51:29.285786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:57:33.294181 2.999563 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:57:40.299616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:57:48.301117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:04.304119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:36.310390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:04:40.317394 2.999987 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:04:47.323178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:04:55.325106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:11.327809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:43.334281 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:08:10.205548 0.000188 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:08:10.205900 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:25.357247 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:42.506369 0.172621 tcp 10.0.2.16 49880 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:08:42.679531 0.210988 tcp 10.0.2.16 49881 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:08:42.891723 0.282024 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:08:43.174410 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:43.175034 3.001442 tcp 10.0.2.16 49882 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:08:52.175597 0.000000 tcp 10.0.2.16 49882 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:08:58.555180 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:04.173134 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:09.180378 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:14.089537 0.172458 tcp 10.0.2.16 49883 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:14.187381 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:14.262317 0.205641 tcp 10.0.2.16 49884 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:14.469025 0.105087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 388 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:09:14.574726 0.124129 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 769 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:11:47.341589 3.000062 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 09:11:54.347643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:02.348842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:18.352076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:50.358027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:18:54.365524 3.000173 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:19:01.371079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:09.372708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:25.376109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:57.382152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:01.389566 3.000109 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:26:08.395193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:16.397298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:32.400102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:27:04.406268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:08.413866 2.999637 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:33:15.419684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:23.420967 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:39.423552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:34:11.430168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:39:35.255959 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:39:35.256301 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:39:53.081638 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:11.682394 0.172582 tcp 10.0.2.16 49885 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:11.855468 0.205060 tcp 10.0.2.16 49886 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:12.061550 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:15.437462 2.999891 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 09:40:22.443387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:28.722629 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:30.445054 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:45.468673 0.183195 tcp 10.0.2.16 49887 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:45.652106 0.208950 tcp 10.0.2.16 49888 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:45.862040 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:46.447762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:04.023507 0.270082 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 405 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.294277 0.111235 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 664 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.294866 3.002512 tcp 10.0.2.16 49889 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:41:04.404649 0.096278 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 225 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.501622 0.269201 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:07.768939 0.269878 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 563 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.043420 0.331703 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.374389 0.289717 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1207 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.664626 0.810776 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1299 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:12.475937 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:13.296501 0.000000 tcp 10.0.2.16 49889 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:41:18.453841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:19.205429 0.281673 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:25.294046 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:30.250651 0.000106 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:41:30.301194 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:35.308816 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:47:22.461409 3.000161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:47:29.466942 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:37.468525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:53.472163 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:48:25.477637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:54:29.485542 2.999579 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:54:36.491457 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:54:44.492387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:00.495650 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:32.501869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:01:36.509357 3.000222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:01:43.515362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:01:51.516454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:07.519442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:39.525642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:08:43.533190 2.999976 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:08:50.538953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:08:58.540831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:14.543807 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:46.549640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:11:22.628039 0.000124 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:11:22.628371 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:11:39.142103 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:11:54.959067 0.173404 tcp 10.0.2.16 49890 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:11:55.132979 0.213225 tcp 10.0.2.16 49891 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:11:55.347457 0.115302 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 519 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:11:55.462192 0.095052 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:11:55.463338 2.995721 tcp 10.0.2.16 49892 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:11:55.557682 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:04.467901 0.000000 tcp 10.0.2.16 49892 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:12:13.611516 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:16.475626 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:21.482824 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:26.489676 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:28.744995 0.187950 tcp 10.0.2.16 49893 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:12:28.933533 0.208766 tcp 10.0.2.16 49894 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:12:29.143449 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:45.086549 0.273020 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 396 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:12:45.360257 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:45.360834 3.000361 tcp 10.0.2.16 49895 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:12:54.359551 0.000000 tcp 10.0.2.16 49895 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:13:01.680373 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:06.367093 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:11.253749 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:13:11.374557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:16.381798 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:18.077355 0.172596 tcp 10.0.2.16 49896 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:13:18.250515 0.202111 tcp 10.0.2.16 49897 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:15:50.557027 2.999938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:15:57.562752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:05.564930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:21.567812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:53.573869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:22:57.581558 2.999750 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:23:04.586911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:12.588486 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:28.591422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:24:00.597858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:04.605004 3.000158 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:30:11.611191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:19.613012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:35.615435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:31:07.621922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:11.629418 2.999765 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:37:18.635048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:26.636525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:42.639558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:38:14.645432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:43:24.271562 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:43:24.271884 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:43:42.467116 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:43:58.644848 0.183459 tcp 10.0.2.16 49898 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:43:58.828624 0.202749 tcp 10.0.2.16 49899 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:43:59.032411 4.979288 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.144796 3.942892 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1605 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.145891 2.999164 tcp 10.0.2.16 49900 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:43:59.256561 4.646191 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.529258 0.270434 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:04.121357 0.109842 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 1020 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:04.230356 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:08.143513 0.000000 tcp 10.0.2.16 49900 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:10.607507 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:17.497415 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:18.652807 3.000653 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:44:20.141107 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:22.664606 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:25.148691 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:25.658835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:30.025293 0.280071 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 589 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:30.155754 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:33.300668 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:33.660187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:39.809560 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:44.756687 0.000202 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:44:45.087132 0.272939 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 371 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.361938 0.346575 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1776 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.707989 0.286654 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.709023 3.007484 tcp 10.0.2.16 49901 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:48.995288 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:49.663220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:57.715195 0.000000 tcp 10.0.2.16 49901 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:57.885575 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:03.894098 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:09.712392 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:10.274086 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:14.719990 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:17.092857 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:19.726922 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:21.669308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:45:24.704039 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:29.250171 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:45:31.984543 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:39.014915 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:45.053508 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:52.633818 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:00.284958 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:08.026015 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:12.752736 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:46:13.815032 0.813656 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:46:14.629517 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:14.630129 2.999978 tcp 10.0.2.16 49902 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:46:23.628838 0.000000 tcp 10.0.2.16 49902 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:46:35.636139 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:40.643383 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:45.650837 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:51:25.677045 3.000014 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:51:32.683142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:40.684628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:56.687183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:52:28.693646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:58:32.701026 2.999745 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:58:39.707314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:58:47.708404 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:03.711389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:35.717280 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:05:39.724813 3.000136 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:05:46.730897 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:05:54.732178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:10.735410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:42.741365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:12:46.749001 3.000166 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:12:53.754596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:01.756102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:17.759003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:49.765622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:16:33.030577 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:16:33.030898 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:16:51.646797 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:07.715090 0.173486 tcp 10.0.2.16 49903 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:07.888967 0.204859 tcp 10.0.2.16 49904 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:08.094882 0.112705 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 421 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:17:08.207169 0.096208 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:17:08.208206 3.006452 tcp 10.0.2.16 49905 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:17:08.303947 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:17.213671 0.000000 tcp 10.0.2.16 49905 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:17:23.993686 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:29.211741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:34.218697 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:39.225190 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:39.728804 0.174923 tcp 10.0.2.16 49906 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:39.904293 0.203429 tcp 10.0.2.16 49907 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:40.108707 0.266961 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 304 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:19:53.773257 2.999635 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 11:20:00.778820 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:08.780413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:24.783528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:56.789422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:00.796976 3.000488 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:27:07.802956 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:15.804580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:31.807266 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:28:03.813607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:07.819211 3.002058 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:34:14.827035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:22.828254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:38.831305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:35:10.836983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:14.845185 2.999592 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:41:21.850391 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:29.852560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:45.855510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:42:17.861186 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:47:51.851793 0.000184 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:47:51.852157 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:09.827513 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:21.869239 3.000080 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:48:28.659589 0.176189 tcp 10.0.2.16 49908 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:48:28.836172 0.212541 tcp 10.0.2.16 49909 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:48:28.875012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:29.049717 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:36.875808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:44.787860 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:52.879098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:00.051528 0.172861 tcp 10.0.2.16 49910 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:49:00.224796 0.203834 tcp 10.0.2.16 49911 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:49:00.429748 0.119710 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 644 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.548899 0.097003 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.549953 3.004791 tcp 10.0.2.16 49912 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:49:00.646494 0.272464 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 353 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.919751 0.277094 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 584 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:04.195904 0.280639 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:07.480524 0.290255 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1247 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:07.771477 0.825137 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1122 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:08.597244 0.356550 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1460 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:08.953141 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:09.552737 0.000000 tcp 10.0.2.16 49912 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:49:16.603679 0.272873 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:21.550698 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:24.885372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:26.557904 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:31.564920 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:55:28.892632 3.000001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:55:35.898871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:55:43.900421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:55:59.903431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:56:31.909284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:02:35.916933 2.999772 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:02:42.922914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:02:50.923824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:06.927630 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:38.933234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:09:42.940531 2.999993 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:09:49.946819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:09:57.948084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:13.951112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:45.957353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:16:49.963194 3.001605 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:16:56.970683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:04.972103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:20.975340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:52.980766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:19:20.787927 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:19:20.788289 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:37.271384 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:55.892582 0.180889 tcp 10.0.2.16 49913 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:19:56.073956 0.210478 tcp 10.0.2.16 49914 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:19:56.285503 0.097321 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:19:56.383482 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:56.384042 2.998551 tcp 10.0.2.16 49915 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:05.381479 0.000000 tcp 10.0.2.16 49915 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:15.055595 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:17.378629 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:22.385778 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:27.393378 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:31.912101 0.178525 tcp 10.0.2.16 49916 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:20:32.085618 0.210591 tcp 10.0.2.16 49917 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:20:32.297274 0.118895 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:20:32.415700 0.268633 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:20:32.416744 2.998057 tcp 10.0.2.16 49918 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:32.684961 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:41.413109 0.000000 tcp 10.0.2.16 49918 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:50.666608 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:53.410445 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:58.417878 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:21:03.425003 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:21:08.625162 0.191585 tcp 10.0.2.16 49919 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:21:08.817160 0.211474 tcp 10.0.2.16 49920 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:23:56.988829 3.000241 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:24:03.994427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:11.995683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:27.998793 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:25:00.005226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:04.012877 3.000209 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:31:11.018512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:19.019937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:35.023352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:32:07.028648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:11.036502 3.000268 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:38:18.042284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:26.044006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:42.046586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:39:14.052957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:18.060056 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:45:25.067183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:33.068857 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:49.072342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:46:21.076925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:51:20.888081 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:51:20.888374 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:51:38.973871 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:51:55.572433 0.173259 tcp 10.0.2.16 49921 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:51:55.746158 0.218776 tcp 10.0.2.16 49922 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:51:55.965910 4.997838 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 944 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.071244 4.026043 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2170 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.071846 3.000745 tcp 10.0.2.16 49923 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:51:56.193233 4.672612 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1502 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.447697 0.262408 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 612 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:01.058639 0.095462 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 656 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:01.154631 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:05.071369 0.000000 tcp 10.0.2.16 49923 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:09.227998 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:17.070389 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:17.349025 0.247519 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:20.594198 0.752916 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1204 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:21.347798 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:22.076347 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:25.084401 2.999971 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:52:27.083017 4.950493 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 4 912 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:28.294959 0.258185 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 399 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:31.559767 0.377901 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1815 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:32.090242 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:32.129490 0.094242 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 660 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:32.224416 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:32.224998 2.999757 tcp 10.0.2.16 49924 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:38.699748 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:39.751035 0.000217 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:52:40.092159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:41.223859 0.000000 tcp 10.0.2.16 49924 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:45.279824 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:53.221161 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:54.242478 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:56.094615 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:58.228225 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:00.952504 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:03.235161 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:08.723502 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:17.445986 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:22.252938 0.000107 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:53:23.564536 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 298 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:28.100786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:53:29.592912 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:37.594732 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:45.876356 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:53.417523 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:59:32.108833 2.999678 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:59:39.113957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:59:47.115535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:03.119106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:35.125213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:06:39.132565 3.000248 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:06:46.138427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:06:54.139474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:10.142670 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:42.148997 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:13:46.156923 2.999863 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:13:53.162520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:01.164027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:17.166913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:49.173077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:20:53.180215 3.000502 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:21:00.186537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:08.188042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:24.191127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:56.196454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:24:13.424676 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:24:13.425016 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:31.740600 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:50.272671 0.178127 tcp 10.0.2.16 49925 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:24:50.444676 0.211882 tcp 10.0.2.16 49926 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:24:50.657524 0.168165 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 246 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:24:50.826238 0.110248 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:24:50.826700 2.995005 tcp 10.0.2.16 49927 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:24:50.935620 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:59.820703 0.000000 tcp 10.0.2.16 49927 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:08.242850 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:11.828240 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 92 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:16.835082 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:21.842323 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:26.680551 0.177336 tcp 10.0.2.16 49928 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:25:26.857791 0.207732 tcp 10.0.2.16 49929 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:25:27.066578 0.095679 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:25:27.163203 3.001343 tcp 10.0.2.16 49930 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:36.162798 0.000000 tcp 10.0.2.16 49930 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:48.160351 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:53.167364 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:58.174872 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:28:00.204330 2.999720 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:28:07.210498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:15.211816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:31.214360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:29:03.220679 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:07.226675 3.002217 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:35:14.234264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:22.235724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:38.239005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:36:10.245008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:14.252276 3.000422 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:42:21.258641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:29.260132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:45.262663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:43:17.269003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:21.276221 3.000448 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:49:28.282255 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:36.283738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:52.286663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:50:24.292535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:55:33.848051 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:55:33.848341 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:55:50.081652 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:06.249366 0.172513 tcp 10.0.2.16 49931 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:06.422186 0.205377 tcp 10.0.2.16 49932 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:06.628563 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:21.996743 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:28.300123 3.000757 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:56:35.306134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:40.606136 0.179399 tcp 10.0.2.16 49933 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:40.780368 0.221657 tcp 10.0.2.16 49934 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:41.003047 0.174835 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 390 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.178536 0.114794 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.179111 2.999587 tcp 10.0.2.16 49935 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:56:41.292824 0.097039 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 311 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.390566 0.173395 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:43.307821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:44.559939 0.171004 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:47.734462 0.343004 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1759 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.077014 0.289343 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1160 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.366871 0.513510 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.880943 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:50.187787 0.000000 tcp 10.0.2.16 49935 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:56:56.577207 0.179760 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:59.310412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:59.761422 2.433519 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:00.277603 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:06.160375 0.169847 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 365 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:07.202151 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:09.325574 0.407557 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1388 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:09.732107 0.289727 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1264 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:10.022420 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:12.209501 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:15.634182 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:21.913573 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:26.750071 0.000127 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:57:28.082253 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:31.316254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:57:35.803202 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:43.183843 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:48.811673 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:55.060951 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:00.488358 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:07.579035 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 314 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:12.255057 0.000283 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:58:16.571748 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:25.054439 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:03:35.324402 3.000001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 14:03:42.330191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:03:50.331415 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:06.334193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:38.340409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:10:42.348145 2.999955 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:10:49.353819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:10:57.355590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:13.358149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:45.365049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:17:49.371968 3.000071 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:17:56.378213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:04.379091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:20.382298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:52.388503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:24:56.396218 3.000184 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:25:03.402347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:11.403433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:27.406335 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:59.412439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:28:58.950986 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:28:58.951296 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:14.944231 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:32.914022 0.173672 tcp 10.0.2.16 49936 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:29:33.088065 0.224014 tcp 10.0.2.16 49937 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:29:33.313303 0.203282 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 338 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:29:33.517210 0.111407 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 685 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:29:33.517772 3.006861 tcp 10.0.2.16 49938 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 14:29:33.627801 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:42.522830 0.000000 tcp 10.0.2.16 49938 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 14:29:52.127670 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:54.520622 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:59.528106 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:30:04.535292 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:30:07.681431 0.172661 tcp 10.0.2.16 49939 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:30:07.854485 0.202705 tcp 10.0.2.16 49940 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:30:08.058234 0.096039 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:32:03.419825 3.000680 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 14:32:10.425491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:32:18.427466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:32:34.430225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:33:06.436239 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:10.443843 3.000215 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:39:17.449448 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:25.451136 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:41.454345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:40:13.460676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:17.468002 3.000309 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:46:24.473537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:32.475665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:48.478437 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:47:20.484027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:24.492193 3.000161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:53:31.497653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:39.499552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:55.502231 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:54:27.508813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:31.515677 3.000545 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:00:36.088440 0.000187 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:00:36.088811 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:00:38.522077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:46.523161 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:54.314189 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:02.526502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:10.723123 0.172283 tcp 10.0.2.16 49941 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:10.895938 0.220865 tcp 10.0.2.16 49942 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:11.117784 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:28.613943 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:34.532701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:44.518949 0.183239 tcp 10.0.2.16 49943 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:44.702683 0.202988 tcp 10.0.2.16 49944 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:44.906690 0.174772 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 303 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.082128 0.111270 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 635 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.082777 2.998587 tcp 10.0.2.16 49945 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:01:45.192905 0.096028 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.289701 0.174643 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 609 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:48.462811 0.173871 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:51.637085 0.331823 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:51.968265 0.285692 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:52.254485 0.515715 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1072 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:52.770859 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:54.080091 0.000000 tcp 10.0.2.16 49945 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:01:58.366821 0.174227 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 506 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:01.541581 4.546463 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1273 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:02.060625 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:08.841832 0.174609 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 450 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:11.095102 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:12.016384 0.341061 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1700 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:12.357003 0.297752 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1351 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:12.655441 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:16.102351 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:21.299519 0.353199 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:21.652718 0.000000 icmp 115.69.240.13 0x000b -> 10.0.2.16 0x0000 TXD 192 1 202 flow=Background 1970/01/04 15:02:26.246622 0.000103 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:02:29.421233 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:37.653170 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:43.531412 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:51.293006 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:57.901943 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:05.563509 0.959382 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:06.522891 0.000000 icmp 223.19.48.1 0x000b -> 10.0.2.16 0x0000 TXD 192 1 281 flow=Background 1970/01/04 15:03:10.249568 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:03:11.141262 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:19.783664 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:26.333555 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:34.735690 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:07:38.539668 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 15:07:45.545724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:07:53.547721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:09.550399 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:41.555903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:14:45.563926 2.999705 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:14:52.569346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:00.571485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:16.573842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:48.580574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:21:52.588386 3.000038 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:21:59.593698 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:07.595091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:23.598229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:55.603813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:28:59.610647 3.001318 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:29:06.617657 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:29:14.618678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:29:30.622197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:30:02.628262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:33:53.350497 0.000107 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:33:53.350679 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:11.095146 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:26.832925 0.173713 tcp 10.0.2.16 49946 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:34:27.007066 0.217276 tcp 10.0.2.16 49947 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:34:27.225339 0.174199 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.400047 0.115669 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.400414 3.002938 tcp 10.0.2.16 49948 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:34:27.514919 0.098125 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 357 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.613633 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:36.401998 0.000000 tcp 10.0.2.16 49948 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:34:46.476096 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:48.399975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:53.406759 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:58.413263 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:35:02.842477 0.183533 tcp 10.0.2.16 49949 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:35:03.025924 0.208721 tcp 10.0.2.16 49950 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:36:06.635780 2.999863 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 15:36:13.641417 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:36:21.643035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:36:37.646464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:37:09.652055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:13.659583 3.000609 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:43:20.665811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:28.666705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:44.670061 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:44:16.676092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:20.683967 3.000020 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:50:27.689697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:35.690744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:51.694193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:51:23.699900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:27.707207 3.000543 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:57:34.713353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:42.715089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:58.717752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:58:30.724271 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:04:34.731729 2.999753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:04:41.737118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:04:49.739220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:05.742195 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:11.620723 0.000128 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:05:11.621012 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:05:28.485144 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:05:37.747919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:45.803793 0.176166 tcp 10.0.2.16 49951 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:05:45.980440 0.203147 tcp 10.0.2.16 49952 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:05:46.184575 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:03.294733 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:22.053540 0.172980 tcp 10.0.2.16 49953 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:06:22.226999 0.199766 tcp 10.0.2.16 49954 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:06:22.427781 0.115985 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.543145 0.169975 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 342 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.544311 3.002493 tcp 10.0.2.16 49955 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:06:22.713506 0.095616 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 368 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.809623 0.177182 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 466 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:25.987620 0.171040 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.162085 0.511484 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.674169 0.285610 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.960346 0.341330 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1402 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:30.300836 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:31.544993 0.000000 tcp 10.0.2.16 49955 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:06:38.145211 0.170477 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:41.319588 0.520040 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1291 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:41.840198 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:43.542635 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:48.319513 0.172866 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 638 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:48.550064 3.293713 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1657 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:51.843026 0.286035 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:52.129646 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:53.556741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:57.582823 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:03.611325 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:08.248442 0.000142 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:07:09.710384 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:16.209427 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:24.512064 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:32.343216 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:38.281111 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:44.400553 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:52.982863 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:57.749013 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:07:58.991478 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:08:06.621858 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:11:41.755749 2.999490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 16:11:48.761436 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:11:56.762564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:12.766268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:44.771662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:18:48.779120 3.000647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:18:55.785401 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:03.787131 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:19.790043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:51.795914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:25:55.803733 2.999815 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:26:02.809205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:10.810993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:26.813727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:58.819764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:02.827773 2.999429 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:33:09.833190 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:17.834472 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:33.838090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:34:05.843733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:38:21.131613 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:38:21.131941 0.374083 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:38:21.506753 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:21.507618 2.998337 tcp 10.0.2.16 49956 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:38:30.503961 0.000000 tcp 10.0.2.16 49956 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:38:37.264737 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:42.501569 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:47.508653 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:52.516101 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:54.393781 1.822392 tcp 10.0.2.16 49957 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:38:56.215855 1.471131 tcp 10.0.2.16 49958 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:38:57.688136 0.870147 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:38:58.558664 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:58.559292 2.999528 tcp 10.0.2.16 49959 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:07.567420 0.000000 tcp 10.0.2.16 49959 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:17.552217 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:19.565057 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:24.572201 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:29.579549 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:36.081218 1.916344 tcp 10.0.2.16 49960 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:39:37.998108 1.618626 tcp 10.0.2.16 49961 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:39:39.617802 0.636148 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:39:40.255190 2.993458 tcp 10.0.2.16 49962 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:49.257835 0.000000 tcp 10.0.2.16 49962 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:40:01.255387 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:06.262476 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:09.851437 3.000281 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 16:40:11.269806 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:16.857063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:40:24.858961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:40:40.861904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:41:12.868313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:16.875578 2.999492 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:47:23.881424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:31.882559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:47.886070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:48:19.891478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:23.899545 2.999768 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:54:30.905384 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:38.906962 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:54.909925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:55:26.915745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:01:30.923484 3.000220 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:01:37.928773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:01:45.931063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:01.933324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:33.939660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:08:37.946933 3.000880 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:08:44.953286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:08:52.954273 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:08.957957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:40.963635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:10:09.385041 0.000086 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:10:09.385221 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:26.689787 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:42.276585 0.174226 tcp 10.0.2.16 49963 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:10:42.451306 0.218909 tcp 10.0.2.16 49964 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:10:42.671297 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:58.585836 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:16.944289 0.173414 tcp 10.0.2.16 49965 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:11:17.118251 0.205283 tcp 10.0.2.16 49966 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:11:17.324582 0.168012 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.493210 0.123198 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.493791 3.002762 tcp 10.0.2.16 49967 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:11:17.615920 0.095037 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.711490 0.179874 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:20.887406 0.173219 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 679 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.062856 0.377275 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1689 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.439297 0.285383 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.725229 0.506653 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1297 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:25.232479 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:26.495535 0.000000 tcp 10.0.2.16 49967 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:11:34.226398 0.179578 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 582 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:37.401662 1.091085 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:37.907529 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:43.500130 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:46.143785 0.172887 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 685 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:48.507093 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:49.318851 0.373497 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1683 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:49.691733 0.284936 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:49.977105 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:55.236610 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:59.753533 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:12:03.839512 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:10.849292 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:19.591944 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:27.052879 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:34.082652 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:42.725110 0.401068 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:43.126178 0.000000 icmp 113.252.247.200 0x0303 -> 10.0.2.16 0x612b URP 192 1 135 flow=Background 1970/01/04 17:12:47.251060 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:12:49.855144 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:57.126058 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:13:05.468007 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:13:13.469431 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:15:44.971761 2.999714 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:15:51.977205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:15:59.978199 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:15.981548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:47.987319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:22:51.995524 2.999417 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:22:59.000684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:07.002672 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:23.005735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:55.011515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:29:59.019516 2.999940 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:30:06.025164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:30:14.026611 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:30:30.030086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:31:02.035185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:06.043711 2.999716 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:37:13.049512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:21.050436 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:37.053579 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:38:09.059295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:43:23.412246 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:43:23.412545 0.176520 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 297 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:23.589805 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:23.590546 3.005361 tcp 10.0.2.16 49968 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:43:32.595039 0.000000 tcp 10.0.2.16 49968 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:43:41.798415 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:44.591948 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:49.598969 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:54.606437 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:58.566394 0.183429 tcp 10.0.2.16 49969 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:43:58.750378 0.203666 tcp 10.0.2.16 49970 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:43:58.955070 0.137747 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 518 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:59.092321 0.095232 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:59.188054 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:44:13.067708 3.000391 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:44:15.396045 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:44:20.072557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:44:28.074423 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:44:32.422121 0.172959 tcp 10.0.2.16 49971 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:44:32.595604 0.214214 tcp 10.0.2.16 49972 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:44:44.077612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:45:16.083446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:20.090618 3.000851 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:51:27.096557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:35.098663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:51.101627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:52:23.107518 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:27.115225 3.000337 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:58:34.120813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:42.122177 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:58.125339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:30.131643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:05:34.139440 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:05:41.144932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:05:49.145968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:06:05.149230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:06:37.155440 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:12:41.162727 3.000707 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:12:48.168558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:12:56.169983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:12.173488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:44.179004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:15:01.350558 0.000192 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:15:01.350924 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:17.043230 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:33.201062 0.172504 tcp 10.0.2.16 49973 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:15:33.373966 0.208553 tcp 10.0.2.16 49974 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:15:33.583076 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:52.233788 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:08.689145 0.173873 tcp 10.0.2.16 49975 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:16:08.863498 0.227367 tcp 10.0.2.16 49976 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:16:09.091965 0.178007 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.270698 0.123372 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.271310 3.000584 tcp 10.0.2.16 49977 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:16:09.392791 0.097561 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.491043 0.171231 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 531 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:12.663353 0.168460 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:15.827217 0.366156 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:16.193050 0.302232 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1257 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:16.495837 0.510203 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:17.006615 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:18.270545 0.000000 tcp 10.0.2.16 49977 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:16:24.469708 0.186479 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 495 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:27.654715 2.614521 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1362 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:28.165229 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:34.203869 0.169174 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 558 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:35.275279 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:37.368355 0.367022 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1647 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:37.734833 0.288782 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1366 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:38.024167 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:40.282840 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:43.176874 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:49.325940 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:54.252201 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:16:55.885066 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:02.905527 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:08.733818 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:17.345915 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:22.953811 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:28.291751 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:35.151765 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:39.748383 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:17:43.143135 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:50.052793 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:19:48.186874 2.999839 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 18:19:55.192796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:03.193952 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:19.197685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:51.203042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:26:55.210666 2.999985 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:27:02.216619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:10.218129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:26.220883 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:58.227521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:02.232450 3.002243 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:34:09.240330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:17.242430 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:33.245095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:35:05.251143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:09.258504 3.000444 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:41:16.264909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:24.266782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:40.268835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:42:12.275263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:02.078570 0.000149 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:48:02.078883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:16.283497 2.999728 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:48:19.633246 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:23.288581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:31.290060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:34.780112 0.172815 tcp 10.0.2.16 49978 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:48:34.953459 0.206139 tcp 10.0.2.16 49979 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:48:35.160603 0.173337 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:48:35.334450 0.111062 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 588 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:48:35.334811 2.995510 tcp 10.0.2.16 49980 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:48:35.445053 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:44.328760 0.000000 tcp 10.0.2.16 49980 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:48:47.292805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:52.430369 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:56.336096 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:01.343510 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:06.351004 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:10.499006 0.193736 tcp 10.0.2.16 49981 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:49:10.693190 0.205918 tcp 10.0.2.16 49982 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:49:10.900289 0.099184 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:49:19.299558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:23.306918 2.999837 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:55:30.312222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:38.314074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:54.317187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:56:26.323419 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:02:30.331359 2.999783 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:02:37.337064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:02:45.338158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:01.341422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:33.346760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:09:37.354806 2.999597 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:09:44.360830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:09:52.362065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:08.365275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:40.371046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:16:44.378623 2.999919 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:16:51.384697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:16:59.385890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:15.389300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:47.395592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:19:31.635603 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:19:31.635972 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:19:48.459939 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:04.937617 0.324262 tcp 10.0.2.16 49983 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:05.262252 0.214039 tcp 10.0.2.16 49984 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:05.477290 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:23.669836 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:41.697833 0.173096 tcp 10.0.2.16 49985 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:41.871383 0.215455 tcp 10.0.2.16 49986 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:42.087962 0.173773 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.262356 0.117753 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 762 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.262946 2.988052 tcp 10.0.2.16 49987 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:20:42.379278 0.096677 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 391 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.476691 0.170996 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 525 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:45.651746 0.174948 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 664 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:48.826445 0.357323 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1413 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.183031 0.285567 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1276 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.469205 0.526418 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1020 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.996093 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:51.249670 0.000000 tcp 10.0.2.16 49987 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:20:58.099186 0.170316 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:01.274189 1.983048 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1284 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:01.794876 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:08.264314 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:08.754556 0.174751 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:11.928843 0.349698 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1657 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:12.277732 0.295395 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1329 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:12.573748 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:13.271429 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:21.142425 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 295 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:25.748871 0.000142 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:21:28.262884 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:36.915372 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:42.493130 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:48.772216 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:57.585312 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:04.344799 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:09.251380 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:22:13.227851 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:20.457347 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:25.845598 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:33.446180 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:23:51.402386 3.000729 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 19:23:58.408400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:06.410169 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:22.412770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:54.419354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:30:58.424725 3.001975 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:31:05.433130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:31:13.433930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:31:29.437270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:32:01.443069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:05.450061 3.000436 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:38:12.456252 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:20.457581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:36.461151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:39:08.466860 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:12.475057 2.999635 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:45:19.480304 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:27.481592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:43.485108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:46:15.490955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:19.498818 1.237537 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/04 19:52:26.104580 4.224963 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/04 19:52:38.331398 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:57.538589 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:59.722180 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:52:59.722515 0.171739 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 241 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:52:59.895020 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:52:59.895987 3.000549 tcp 10.0.2.16 49988 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:53:08.895952 0.000000 tcp 10.0.2.16 49988 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:53:15.835469 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:20.893378 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:25.900048 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:29.544843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:53:30.907343 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:32.864879 0.174096 tcp 10.0.2.16 49989 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:53:33.039682 0.219110 tcp 10.0.2.16 49990 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:53:33.259799 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:52.127382 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:07.181403 0.173070 tcp 10.0.2.16 49991 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:54:07.354823 0.207507 tcp 10.0.2.16 49992 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:54:07.563554 0.098304 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:54:07.662516 0.122148 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:54:07.663079 3.001160 tcp 10.0.2.16 49993 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:54:16.662302 0.000000 tcp 10.0.2.16 49993 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:54:28.660394 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:33.667217 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:38.674707 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:59:33.550841 3.001887 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 19:59:40.558218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:59:48.559529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:04.563559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:36.569024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:06:40.576526 3.000314 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:06:47.582011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:06:55.583803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:07:11.587189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:07:43.593010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:13:47.600748 2.999678 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:13:54.606385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:02.607674 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:18.610741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:50.616563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:06.470037 1.992538 arp 0.0.0.0 who 10.0.2.16 INT 3 126 flow=Background-ARP 1970/01/01 01:00:06.470181 0.000000 ipv6-icmp :: 135 -> ff02::1:ff56:8562 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:06.475533 3.990149 ipv6-icmp fe80::6dd3:1409:3456:8562 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:06.475587 0.494588 ipv6-icmp fe80::6dd3:1409:3456:8562 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:06.519653 3.004626 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:00:06.702765 2.766314 arp 10.0.2.16 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:07.720914 0.090625 udp fe80::6dd3:1409:3456:8562 50791 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:00:07.721218 0.090645 udp 10.0.2.16 54326 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:00:07.721398 0.000140 arp 10.0.2.2 who 10.0.2.16 CON 2 84 flow=Background-ARP 1970/01/01 01:00:07.811863 0.000000 icmp 10.0.2.2 0x000b -> 10.0.2.16 0x0000 TXD 192 1 92 flow=Background 1970/01/01 01:00:08.024213 0.075112 udp 10.0.2.16 50005 <-> 8.8.8.8 53 CON 0 0 2 257 flow=From-Botnet-V1-DNS 1970/01/01 01:00:08.101208 0.074571 udp 10.0.2.16 51357 <-> 8.8.8.8 53 CON 0 0 2 257 flow=From-Botnet-V1-DNS 1970/01/01 01:00:08.176495 0.279820 tcp 10.0.2.16 49161 -> 193.45.10.144 80 FSPA* 0 0 10 832 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:00:13.529697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:14.471151 0.000000 ipv6-icmp fe80::6dd3:1409:3456:8562 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:21.531616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:37.534645 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:01:09.540225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:04:55.083813 0.000146 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:04:55.084121 0.178219 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:04:58.259530 0.506579 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 959 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:04:58.766764 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:04:58.767694 0.000000 tcp 10.0.2.16 49162 -> 66.148.64.18 13606 S_ 0 1 66 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:05:07.052091 0.170951 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 534 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.227493 0.316517 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.544410 0.280048 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1239 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:05:10.825053 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:16.205714 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:25.108357 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:28.763172 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:30.475850 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:33.770852 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:36.173851 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:38.466906 0.000182 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:05:38.777645 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:44.666104 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:50.444670 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:05:56.814003 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:03.013013 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 302 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:10.152574 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:16.231988 0.204318 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:16.436306 0.000000 icmp 95.57.211.247 0x0303 -> 10.0.2.16 0x6a50 URP 192 1 164 flow=Background 1970/01/01 01:06:20.968348 0.000164 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:06:24.273206 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:33.085653 0.167706 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:06:33.254034 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:06:33.254611 0.000000 tcp 10.0.2.16 49163 -> 66.148.64.18 13606 S_ 0 1 66 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:06:52.213329 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:03.249304 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:07.965489 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:07:08.256792 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:09.473148 0.095088 udp fe80::6dd3:1409:3456:8562 59045 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:07:09.473458 0.095151 udp 10.0.2.16 51914 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:09.473619 0.094990 icmp 10.0.2.2 0x000b -> 10.0.2.16 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:07:09.768730 1.501463 udp 10.0.2.16 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:12.051039 0.073846 udp 10.0.2.16 64271 <-> 8.8.8.8 53 CON 0 0 2 244 flow=From-Botnet-V1-DNS 1970/01/01 01:07:12.125559 0.214487 tcp 10.0.2.16 49164 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:12.341728 0.076883 udp 10.0.2.16 57037 <-> 8.8.8.8 53 CON 0 0 2 162 flow=From-Botnet-V1-DNS 1970/01/01 01:07:12.419242 0.284755 tcp 10.0.2.16 49165 -> 173.194.70.94 80 SRPA* 0 0 27 20494 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:12.762606 0.117465 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 576 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:07:12.879716 0.090947 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:07:12.971255 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:13.263714 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:13.547849 3.000645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:07:20.553652 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:28.555426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:30.097577 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:44.558415 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:47.845313 0.166163 tcp 10.0.2.16 49166 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:48.011872 0.203377 tcp 10.0.2.16 49167 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:16.564877 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:20.572159 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:14:27.578095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:35.579737 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:51.582111 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:15:23.588568 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:27.595902 3.000191 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:21:34.601774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:42.603684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:58.606385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:30.612760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:34.619443 3.000280 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:28:41.626220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:49.627043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:05.630316 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:37.636397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:41.643895 2.999882 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:35:48.649650 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:56.651296 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:12.654305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:44.660055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:37:49.433590 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:37:49.433930 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:05.326831 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:23.056501 0.168052 tcp 10.0.2.16 49168 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:23.224825 0.201719 tcp 10.0.2.16 49169 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:23.427598 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:40.897929 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:38:55.901641 0.167542 tcp 10.0.2.16 49170 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:56.069938 0.197554 tcp 10.0.2.16 49171 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:56.268411 0.181275 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:38:56.450320 0.106412 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 605 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:38:56.450875 3.003006 tcp 10.0.2.16 49172 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:38:56.556285 0.091309 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 268 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 01:39:05.452598 0.000000 tcp 10.0.2.16 49172 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 01:39:12.765767 0.074029 udp 10.0.2.16 51898 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 01:39:12.840434 0.073788 udp 10.0.2.16 58451 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 01:39:17.450171 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:39:22.457502 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:39:27.464276 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:42:48.667646 3.000334 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:42:55.673791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:03.675491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:19.678318 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:51.684653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:49:55.691922 3.000058 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:50:02.697816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:10.699342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:26.702586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:58.708103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:02.715952 3.000416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:57:09.721694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:17.722818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:33.725949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:58:05.732110 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:09.739596 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:04:16.746081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:24.746792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:40.750286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:05:12.756012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:09:21.684071 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:09:21.684424 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:09:40.401156 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:09:57.589853 0.167331 tcp 10.0.2.16 49173 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:09:57.757384 0.202819 tcp 10.0.2.16 49174 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:09:57.961109 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:14.831058 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:32.397568 0.166713 tcp 10.0.2.16 49175 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:10:32.564117 0.195640 tcp 10.0.2.16 49176 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:10:32.760659 0.648867 rtcp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:32.852660 1.376766 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:32.853188 2.987424 tcp 10.0.2.16 49177 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:10:33.019474 0.707084 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2081 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:34.229987 0.170895 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 372 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:10:37.403106 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:41.839049 0.000000 tcp 10.0.2.16 49177 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:10:52.748624 0.074208 udp 10.0.2.16 55140 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 02:10:52.823565 0.073162 udp 10.0.2.16 54706 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 02:10:53.847053 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:10:58.854005 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:11:03.860879 0.000000 rtcp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:11:16.763728 2.999796 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 02:11:23.769654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:31.771077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:47.774160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:12:19.780396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:23.787376 3.000685 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:18:30.793596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:38.795285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:54.798134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:19:26.804145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:25:30.811412 3.000042 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:25:37.817779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:25:45.818991 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:01.822275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:33.828096 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:37.835429 3.000648 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:32:44.841259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:52.842716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:08.845865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:40.852600 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:39:44.859941 3.000154 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:39:51.865306 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:39:59.867303 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:15.869748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:46.724866 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:40:46.725207 0.107011 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:46.831491 0.092087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:46.832626 2.996459 tcp 10.0.2.16 49178 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:40:46.924102 0.240855 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 289 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 02:40:47.165476 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:40:47.875675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:55.837482 0.000000 tcp 10.0.2.16 49178 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 02:41:04.420462 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:07.718167 0.074195 udp 10.0.2.16 54152 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 02:41:07.793004 0.073150 udp 10.0.2.16 51034 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 02:41:07.835056 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:12.842093 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:17.849062 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 02:41:20.937561 0.182779 tcp 10.0.2.16 49179 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:41:21.120636 0.202623 tcp 10.0.2.16 49180 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:46:51.884013 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:46:58.889258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:06.890945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:22.893604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:54.899830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:53:58.907455 3.000247 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:54:05.913657 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:13.914667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:29.917928 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:55:01.923844 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:05.931427 3.000204 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:01:12.937788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:20.938762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:36.941827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:02:08.948118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:12.955766 2.999822 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:08:19.961455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:27.962487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:43.966192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:09:15.971995 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:11:49.612892 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:11:49.613234 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:07.779627 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:26.610984 0.165352 tcp 10.0.2.16 49181 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:12:26.776612 0.230531 tcp 10.0.2.16 49182 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:12:27.008075 4.897785 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.114252 3.880337 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.115208 2.985863 tcp 10.0.2.16 49183 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:12:27.205778 4.594067 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1696 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:27.468235 0.258841 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 635 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:32.012609 0.106597 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 880 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:32.117973 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:36.099901 0.000000 tcp 10.0.2.16 49183 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:12:38.693312 0.263652 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 586 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:12:48.107268 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:53.114268 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:12:58.121384 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:15:19.979508 3.000339 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:15:26.985675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:34.986891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:50.989862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:16:22.996186 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:27.003839 2.999918 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:22:34.009444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:42.011046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:58.013622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:23:30.019515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:34.027438 2.999957 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:29:41.033135 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:49.034695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:05.037697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:37.044113 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:41.051521 2.999873 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:36:48.056887 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:56.058379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:12.061535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:44.067998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:42:50.248434 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:42:50.248746 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:05.650173 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:21.727894 0.165886 tcp 10.0.2.16 49184 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:21.894140 0.195949 tcp 10.0.2.16 49185 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:22.091048 0.262147 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 213 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.354393 0.092552 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.354939 3.003410 tcp 10.0.2.16 49186 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:43:22.447534 0.106809 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 03:43:22.553420 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:31.367319 0.000000 tcp 10.0.2.16 49186 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 03:43:39.789221 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:43.364486 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:48.075066 3.000427 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:43:48.371807 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:53.379488 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 03:43:55.081085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:43:58.478489 0.166173 tcp 10.0.2.16 49187 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:58.645206 0.199810 tcp 10.0.2.16 49188 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:44:03.082825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:19.086037 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:51.091827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:50:55.098993 3.000686 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:51:02.105358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:10.106864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:26.109345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:58.115639 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:02.122724 3.000617 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:58:09.129111 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:17.130685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:33.133520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:59:05.139849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:09.147361 3.000143 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:05:16.153325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:24.154876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:40.157762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:06:12.164049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:16.171221 3.000164 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:12:23.177433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:31.178499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:47.181893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:13:19.187363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:14:18.823499 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:14:18.823818 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:14:34.296148 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:14:52.165643 0.167440 tcp 10.0.2.16 49189 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:14:52.333408 0.225127 tcp 10.0.2.16 49190 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:14:52.559545 4.854034 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:52.653815 4.449659 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1393 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:52.654357 3.002202 tcp 10.0.2.16 49191 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:14:52.924988 4.809715 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:53.041537 0.265334 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:14:57.733960 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:01.654758 0.000000 tcp 10.0.2.16 49191 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:15:04.419105 0.260786 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 557 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:15:13.652131 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:18.659532 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:15:23.666894 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:19:23.195153 2.999701 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 04:19:30.200663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:38.202547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:54.205133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:20:26.211654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:26:30.218925 3.000017 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:26:37.225359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:26:45.226513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:01.229583 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:33.235724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:37.243333 2.999564 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:33:44.248990 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:52.250090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:08.253417 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:40.259815 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:40:44.267122 2.999711 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:40:51.272718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:40:59.274127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:15.277964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:47.284473 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:45:25.767912 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:45:25.768248 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:45:42.591999 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:45:58.880216 1.847634 tcp 10.0.2.16 49192 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:45:59.122811 0.310321 tcp 10.0.2.16 49193 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:45:59.434072 0.203194 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:45:59.637814 0.232060 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 716 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:45:59.638356 2.992187 tcp 10.0.2.16 49194 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:45:59.868976 0.357234 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 303 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 04:46:00.226799 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:08.628782 0.000000 tcp 10.0.2.16 49194 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 04:46:18.212821 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:20.636380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:25.643911 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:30.651440 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 04:46:33.276872 0.229990 tcp 10.0.2.16 49195 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:46:33.507510 0.265314 tcp 10.0.2.16 49196 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:47:51.291117 3.000382 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 04:47:58.297077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:06.298305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:22.301336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:54.307623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:54:58.315510 2.999572 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:55:05.320598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:13.322459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:29.325477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:56:01.331719 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:05.338540 3.000829 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:02:12.344545 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:20.346393 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:36.349063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:03:08.355466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:12.362293 3.000835 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:09:19.368421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:27.369948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:43.373566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:10:15.379499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:19.387401 2.999321 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:16:26.392476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:34.394319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:50.397337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:52.000412 0.000110 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:16:52.000725 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:08.683644 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:22.403298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:17:23.739912 0.180165 tcp 10.0.2.16 49197 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:17:23.920316 0.221124 tcp 10.0.2.16 49198 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:17:24.142327 4.948137 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 402 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.252192 4.035527 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2083 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.252714 2.987301 tcp 10.0.2.16 49199 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:17:24.364355 4.725618 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:24.633912 0.270365 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 621 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:29.184651 0.202976 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 938 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:29.388187 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:33.238574 0.000000 tcp 10.0.2.16 49199 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:17:36.113693 0.283552 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 532 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:17:45.246645 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:50.253439 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:17:55.260831 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:23:26.410454 3.000180 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:23:33.416494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:41.418487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:57.421274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:24:29.427512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:33.434265 3.000517 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:30:40.440887 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:48.441975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:04.445649 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:36.450844 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:37:40.458523 3.000552 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:37:47.464462 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:37:55.466081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:11.468852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:43.474874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:44:47.482189 3.000927 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:44:54.488870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:02.489833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:18.493287 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:50.499095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:48:08.257468 0.000123 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:48:08.257793 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:25.021439 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:42.190118 0.776243 tcp 10.0.2.16 49200 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:48:42.966639 0.207145 tcp 10.0.2.16 49201 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:48:43.174804 0.147994 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 747 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.322030 0.105008 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.323009 2.998502 tcp 10.0.2.16 49202 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:48:43.427613 0.277615 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 274 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 05:48:43.705746 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:48:52.320177 0.000000 tcp 10.0.2.16 49202 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 05:49:02.064953 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:04.327750 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:09.335464 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:14.342339 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 05:49:17.909638 0.940328 tcp 10.0.2.16 49203 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:49:18.850270 0.230547 tcp 10.0.2.16 49204 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:51:54.506174 3.000790 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:52:01.512962 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:09.514100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:25.517100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:57.522824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:01.531085 2.999777 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:59:08.536315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:16.537621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:32.541176 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:00:04.546797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:08.555129 2.999332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:06:15.560245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:23.561916 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:39.565025 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:07:11.571526 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:15.578429 2.999898 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:13:22.584099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:30.586301 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:46.589134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:14:18.594735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:19:31.144948 0.000120 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:19:31.145269 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:19:49.821129 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:07.861755 0.310342 tcp 10.0.2.16 49205 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:20:08.172376 0.207409 tcp 10.0.2.16 49206 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:20:08.380688 4.934302 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.473421 4.030870 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2153 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.473970 2.998661 tcp 10.0.2.16 49207 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:20:08.626296 4.688125 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1751 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:08.893862 0.265091 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:13.414503 0.204119 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 928 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:13.619171 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:17.470807 0.000000 tcp 10.0.2.16 49207 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:20:21.266595 0.285053 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:20:22.602468 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 06:20:29.478835 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:29.608560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:34.486013 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:37.610026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:39.492617 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:20:53.612704 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:21:25.618905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:29.626095 3.000512 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:27:36.632566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:44.633932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:00.636614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:32.643125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:34:36.650211 3.000013 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:34:43.656623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:34:51.657484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:07.660918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:39.666781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:41:43.674857 2.999311 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:41:50.680164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:41:58.681620 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:14.685237 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:46.690469 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:48:50.698299 3.000263 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:48:57.704454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:05.706088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:21.708772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:53.715019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:50:38.379814 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:50:38.380132 0.110412 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:50:38.490061 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:50:38.491163 3.002095 tcp 10.0.2.16 49208 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:50:47.492294 0.000000 tcp 10.0.2.16 49208 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 06:50:53.641130 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:50:59.489475 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:04.496741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:09.504323 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:09.598427 0.194091 tcp 10.0.2.16 49209 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:09.792782 0.202209 tcp 10.0.2.16 49210 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:09.996369 0.097486 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 358 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:51:10.094371 0.277659 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 210 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 06:51:10.372550 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:26.548967 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 06:51:44.045808 0.167012 tcp 10.0.2.16 49211 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:51:44.213127 0.211853 tcp 10.0.2.16 49212 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:55:57.722257 3.000515 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 06:56:04.727886 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:12.729642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:28.732954 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:57:00.738816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:04.746713 2.999524 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:03:11.751984 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:19.754067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:35.756409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:04:07.763123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:11.770408 2.999844 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:10:18.776256 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:26.777388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:42.780992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:11:14.786654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:18.793704 3.000705 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:17:25.800527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:33.801714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:49.804853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:18:21.810434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:22:10.429666 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:22:10.429985 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:27.203424 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:44.232718 0.180904 tcp 10.0.2.16 49213 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:22:44.414128 0.194654 tcp 10.0.2.16 49214 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:22:44.609751 4.342942 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2142 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:44.716699 3.917384 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:44.717700 2.995570 tcp 10.0.2.16 49215 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:22:44.812183 4.935246 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1419 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:45.078932 0.264692 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 594 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:22:49.747952 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:22:53.711548 0.000000 tcp 10.0.2.16 49215 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:22:55.214264 0.280410 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:23:05.709061 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:23:10.716034 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:23:15.723867 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:24:25.817704 3.000291 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 07:24:32.824426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:40.825253 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:56.828975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:25:28.834455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:32.841829 3.000145 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:31:39.848199 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:47.849841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:03.852595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:35.858337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:38:39.865618 3.000811 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:38:46.872022 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:38:54.873634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:10.877330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:42.882761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:45:46.889799 3.000587 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:45:53.895840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:01.897322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:17.900623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:49.906679 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:52:53.913973 3.000349 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:53:00.919932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:08.921885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:16.542472 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:53:16.542786 0.091519 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 222 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:16.634925 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:16.635807 3.001426 tcp 10.0.2.16 49216 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:24.924692 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:25.635521 0.000000 tcp 10.0.2.16 49216 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:35.159247 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:37.632701 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:42.640407 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:47.647436 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:53.079361 0.190227 tcp 10.0.2.16 49217 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:53:53.269777 0.218255 tcp 10.0.2.16 49218 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:53:53.488923 0.264380 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:53.753894 0.108415 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 666 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 07:53:53.754441 2.995860 tcp 10.0.2.16 49219 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:53:53.861306 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:53:56.930826 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:54:02.748977 0.000000 tcp 10.0.2.16 49219 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 07:54:11.351494 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:14.756211 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:19.763898 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:24.770342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 07:54:29.670180 0.190623 tcp 10.0.2.16 49220 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:54:29.861223 0.229249 tcp 10.0.2.16 49221 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:00:00.937992 3.000112 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:00:07.944118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:15.945659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:31.948206 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:01:03.954503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:07.962221 3.000032 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:07:14.968152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:22.969322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:38.972254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:08:10.978191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:14.985716 3.000200 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:14:21.991959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:29.993563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:45.996332 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:15:18.002750 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:22.009498 3.000878 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:21:29.015862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:37.017340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:53.020361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:22:25.026162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:24:33.841495 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:24:33.841816 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:24:51.897639 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:07.204404 0.202408 tcp 10.0.2.16 49222 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:25:07.407547 0.226347 tcp 10.0.2.16 49223 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:25:07.634790 4.005076 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:07.726296 4.759524 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1252 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:07.726858 2.997945 tcp 10.0.2.16 49224 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:07.992416 3.964694 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1996 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:08.099581 0.266853 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 658 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:12.749639 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:12.750163 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:16.723356 0.000000 tcp 10.0.2.16 49224 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:20.508640 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:28.089911 0.267062 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 456 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:28.720667 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:31.354711 0.797125 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1313 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:32.152403 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:33.727618 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:38.734772 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:40.278582 0.311382 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.592175 0.317034 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.908874 0.273909 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:25:43.909753 3.006555 tcp 10.0.2.16 49225 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:44.183430 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:48.959684 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:25:51.183642 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:25:52.915347 0.000000 tcp 10.0.2.16 49225 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:25:57.371551 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:03.390513 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:04.913292 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:08.467601 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:09.919856 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:14.927421 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:15.227161 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:21.907138 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:30.589519 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:35.466250 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:26:37.249151 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:44.159083 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:26:52.430898 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:27:00.603084 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:28:29.034165 3.000111 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 08:28:36.039662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:28:44.041248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:00.044386 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:32.050019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:35:36.057811 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:35:43.063761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:35:51.065156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:07.068249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:39.074263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:42:43.081504 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:42:50.088031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:42:58.089160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:14.092439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:46.098314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:49:50.105701 2.999906 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:49:57.111612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:05.113183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:21.116233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:53.122183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:56:57.130101 2.999765 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:57:04.135340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:10.415138 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:57:10.415459 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:12.137482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:28.140397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:28.721594 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:46.390409 1.461882 tcp 10.0.2.16 49226 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:57:47.852680 1.458730 tcp 10.0.2.16 49227 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:57:49.312382 0.951287 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 403 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:57:50.264270 0.774731 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 645 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 08:57:50.264816 3.001078 tcp 10.0.2.16 49228 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:57:51.038357 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:57:59.264668 0.000000 tcp 10.0.2.16 49228 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 08:58:00.146219 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:58:08.047827 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:11.262369 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:16.269532 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:21.277768 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 08:58:23.061471 0.892598 tcp 10.0.2.16 49229 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:58:23.953954 0.997001 tcp 10.0.2.16 49230 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:58:24.952152 0.550015 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 249 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:04:04.151354 3.002819 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:04:11.159796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:19.160785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:35.164453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:05:07.170364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:11.177794 3.000282 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:11:18.183587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:26.185380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:42.188115 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:12:14.193810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:18.201321 3.000353 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:18:25.207184 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:33.208931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:49.211869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:19:21.218337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:25.225720 2.999896 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:25:32.231270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:40.232646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:56.236378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:26:28.241707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:28:52.409843 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:28:52.410192 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:09.594370 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:24.690418 1.077937 tcp 10.0.2.16 49231 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:29:25.768764 1.183362 tcp 10.0.2.16 49232 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:29:26.953076 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:29:45.646384 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:01.860967 0.767655 tcp 10.0.2.16 49233 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:30:02.629158 0.901449 tcp 10.0.2.16 49234 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:30:03.531782 0.663874 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 290 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:04.196259 0.484134 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:04.196806 3.000015 tcp 10.0.2.16 49235 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 09:30:04.679457 0.482894 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 293 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:05.163062 0.678650 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 695 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:08.839662 0.780561 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 501 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:12.624549 1.062911 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1532 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:13.195108 0.000000 tcp 10.0.2.16 49235 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 09:30:13.686543 1.567073 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1091 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:15.254130 1.210887 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1129 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:16.465534 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:23.440302 0.266255 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 699 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 09:30:25.193014 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:30.199910 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:30:35.207485 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 09:32:32.249382 3.000531 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 09:32:39.255723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:32:47.257287 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:03.259917 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:35.266137 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:39:39.273029 3.001666 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:39:46.280720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:39:54.281640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:10.284248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:42.290112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:46:46.297169 3.000092 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:46:53.303374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:01.304845 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:17.307983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:49.314395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:53:53.321029 3.000921 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:54:00.327898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:08.328694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:24.332262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:56.337566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:00:50.877922 0.000200 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:00:50.878337 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:00.345191 3.000428 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:01:07.271511 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:07.350986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:15.353079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:24.139818 1.919244 tcp 10.0.2.16 49236 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:24.332017 0.224049 tcp 10.0.2.16 49237 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:24.557035 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:31.355894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:41.160217 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:01:58.797173 0.190245 tcp 10.0.2.16 49238 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:58.987705 0.221851 tcp 10.0.2.16 49239 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:01:59.210483 0.107294 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.317282 0.264000 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.318251 2.992059 tcp 10.0.2.16 49240 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:01:59.581800 0.094470 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:01:59.676893 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:03.361986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:02:08.309247 0.000000 tcp 10.0.2.16 49240 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:02:15.629687 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:20.316751 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:25.323588 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:30.330675 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:02:33.186807 0.187598 tcp 10.0.2.16 49241 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:02:33.374793 0.212157 tcp 10.0.2.16 49242 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:08:07.369300 3.000495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:08:14.375305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:22.377000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:38.380308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:09:10.386052 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:14.393263 3.000125 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:15:21.399008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:29.400592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:45.403458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:16:17.410173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:21.417088 3.000821 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:22:28.423484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:36.424863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:52.427420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:23:24.433718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:28.441467 3.000044 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:29:35.446884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:43.449380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:59.451791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:30:31.457536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:32:39.021504 0.000176 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:32:39.021845 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:32:54.933891 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:13.835780 0.185287 tcp 10.0.2.16 49243 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:33:14.021496 0.218418 tcp 10.0.2.16 49244 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:33:14.240806 4.816709 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1358 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.506371 3.753513 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.506906 2.999562 tcp 10.0.2.16 49245 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:14.608208 3.918166 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:14.697218 0.263402 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:19.313974 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:19.314530 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:23.504947 0.000000 tcp 10.0.2.16 49245 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:26.199533 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:35.112150 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:35.502342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 112 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:40.509602 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:43.413549 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:45.517142 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:50.233451 0.274164 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 670 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:53.508602 0.782218 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1069 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:33:54.291711 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:33:54.292282 3.001630 tcp 10.0.2.16 49246 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:33:55.460724 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:34:01.590240 0.266556 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:03.292678 0.000000 tcp 10.0.2.16 49246 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 10:34:04.855383 0.302378 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1773 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:05.157459 0.274649 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 10:34:05.432679 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:13.617145 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:15.290015 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:19.746630 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:20.296916 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:25.304124 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:28.177925 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:34.647547 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:39.464330 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:34:42.689280 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:49.729376 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:34:56.419032 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 296 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:04.009497 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:11.210061 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:18.440867 0.185601 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:35:18.626468 0.000000 icmp 95.57.211.247 0x0303 -> 10.0.2.16 0x6a50 URP 192 1 213 flow=Background 1970/01/01 10:35:22.966604 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:35:25.470481 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 311 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 10:36:35.465149 3.000187 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 10:36:42.471450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:36:50.472525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:06.475775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:38.481406 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:43:42.489316 2.999795 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:43:49.495502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:43:57.496831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:13.499749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:45.505313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:50:49.513084 3.000457 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:50:56.519325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:04.520770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:20.523441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:52.529432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:57:56.537057 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:58:03.542865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:11.544758 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:27.548078 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:59.553305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:03.560839 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:05:10.567148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:18.568957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:34.571738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:55.451954 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:05:55.452305 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:06.577229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:06:12.756780 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:31.327456 1.935256 tcp 10.0.2.16 49247 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:06:31.509771 0.219266 tcp 10.0.2.16 49248 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:06:31.729965 0.270753 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 286 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:06:32.001332 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:32.001874 2.996575 tcp 10.0.2.16 49249 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:06:41.006628 0.000000 tcp 10.0.2.16 49249 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:06:48.588519 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:53.004602 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:06:58.011826 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:07:03.018929 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:07:04.913603 0.183105 tcp 10.0.2.16 49250 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:07:05.096991 0.212483 tcp 10.0.2.16 49251 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:07:05.310402 0.094233 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:07:05.405173 0.100255 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 608 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:12:10.584517 3.001055 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 11:12:17.590789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:25.592454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:41.595522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:13:13.601268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:17.608682 3.000820 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:19:24.614809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:32.616712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:48.619553 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:20:20.625595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:24.633099 2.999691 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:26:31.638748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:39.640622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:55.643121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:27:27.649165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:31.656540 3.000208 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:33:38.662893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:46.664712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:02.667103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:34.673274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:37:27.482231 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:37:27.482584 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:37:45.818853 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:04.569610 0.183371 tcp 10.0.2.16 49252 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:04.753264 0.220339 tcp 10.0.2.16 49253 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:04.974486 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:23.923160 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:41.710790 0.181596 tcp 10.0.2.16 49254 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:41.892300 0.221876 tcp 10.0.2.16 49255 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:42.115038 0.262630 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.378268 0.101801 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.378807 3.004857 tcp 10.0.2.16 49256 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:38:42.479003 0.090521 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 209 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:42.570233 0.261693 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 508 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:45.835049 0.264365 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 547 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.099211 0.301469 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.399832 0.272203 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1350 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:49.672571 0.785976 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1173 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:38:50.459090 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:38:51.382232 0.000000 tcp 10.0.2.16 49256 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 11:38:58.212655 0.259047 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 11:39:03.379752 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:39:08.387597 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:39:13.394319 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 11:40:38.680891 3.000410 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 11:40:45.686898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:40:53.688366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:09.691443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:41.697289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:47:45.704985 3.000071 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:47:52.710771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:00.712775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:16.715393 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:48.721189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:54:52.728663 3.000406 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:54:59.734755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:07.736523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:23.739743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:55.745371 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:01:59.752699 3.000582 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:02:06.758727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:14.759959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:30.763035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:03:02.769168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:06.776716 3.000008 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:09:13.782653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:16.947776 0.000161 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:09:16.948086 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:21.784489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:32.620247 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:37.786831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:47.986019 0.184646 tcp 10.0.2.16 49257 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:09:48.171027 0.211698 tcp 10.0.2.16 49258 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:09:48.383817 0.102205 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 759 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:09:48.485598 0.090845 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 353 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:09:48.486533 3.000681 tcp 10.0.2.16 49259 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:09:48.576969 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:09:57.485351 0.000000 tcp 10.0.2.16 49259 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:06.609078 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:09.482971 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:09.793574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:10:14.490072 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:19.497081 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:24.877395 0.183199 tcp 10.0.2.16 49260 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:25.061045 0.217546 tcp 10.0.2.16 49261 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:25.279614 0.243806 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:10:25.523974 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:25.524540 2.995386 tcp 10.0.2.16 49262 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:34.518576 0.000000 tcp 10.0.2.16 49262 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:10:42.349884 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:46.526770 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:51.533413 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:56.540655 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:10:58.085370 0.183205 tcp 10.0.2.16 49263 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:10:58.268788 0.218237 tcp 10.0.2.16 49264 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:16:13.800366 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 12:16:20.806485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:28.808548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:44.810943 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:17:16.817708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:20.825083 2.999986 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:23:27.830434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:35.831982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:51.835159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:24:23.841113 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:27.848932 2.999654 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:30:34.854929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:42.856057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:58.859142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:31:30.865151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:34.872319 3.000875 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:37:41.879142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:49.880852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:05.883477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:37.889339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:41:12.331207 0.000241 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:41:12.331612 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:29.656215 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:45.723574 1.982036 tcp 10.0.2.16 49265 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:41:45.907680 0.214338 tcp 10.0.2.16 49266 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:41:46.122938 4.713587 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2039 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.224486 3.752384 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1680 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.225460 2.999074 tcp 10.0.2.16 49267 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:41:46.315758 4.216840 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1408 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:46.509060 0.194937 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 474 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:41:50.836022 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:41:55.222841 0.000000 tcp 10.0.2.16 49267 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 12:41:57.686759 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:04.146172 0.214527 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 420 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:07.219987 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:07.360998 0.620592 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:07.982169 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 312 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:12.227163 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:16.754354 0.193542 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:17.234740 3.015663 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:20.249596 0.267742 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 12:42:20.517903 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:28.590741 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:33.457700 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:42:35.380733 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:44.133574 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:52.685600 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:42:59.004379 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:04.702615 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:09.840622 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:17.511121 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:22.458663 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:43:26.173835 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:34.435694 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:43:39.783421 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 12:44:41.897058 2.999823 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 12:44:48.902712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:44:56.903854 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:12.907385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:44.912853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:51:48.920682 3.000342 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:51:55.926602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:03.928453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:19.930749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:51.937323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:58:55.944462 3.000565 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:59:02.950749 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:10.951910 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:26.954618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:58.961467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:02.968833 3.000023 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:06:09.974621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:17.975605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:33.979589 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:07:05.985418 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:09.992608 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:13:16.998610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:24.999637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:41.003165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:58.377852 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:13:58.378159 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:13.009104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:14:16.243619 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:31.950888 0.191708 tcp 10.0.2.16 49268 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:14:32.142987 0.226737 tcp 10.0.2.16 49269 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:14:32.370651 0.170709 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.541944 0.105782 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 542 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.542509 2.998746 tcp 10.0.2.16 49270 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:14:32.646867 0.093387 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:14:32.740769 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:41.539871 0.000000 tcp 10.0.2.16 49270 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:14:49.872140 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:53.547952 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:14:58.554604 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:15:03.561922 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:15:05.767372 0.192437 tcp 10.0.2.16 49271 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:15:05.960183 0.222543 tcp 10.0.2.16 49272 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:20:17.016447 3.000214 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:20:24.022656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:32.024355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:48.026972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:21:20.033265 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:24.040111 3.000689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:27:31.046476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:39.047441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:55.050876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:28:27.056946 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:31.064830 2.999328 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:34:38.070331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:46.071769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:02.074833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:34.081086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:41:38.088271 3.000460 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:41:45.094435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:41:53.095714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:09.098787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:41.104654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:45:09.608292 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:45:09.608636 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:45:27.684416 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:45:46.626422 0.189265 tcp 10.0.2.16 49273 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:45:46.816212 0.225398 tcp 10.0.2.16 49274 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:45:47.042566 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:03.466067 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:21.533682 0.191349 tcp 10.0.2.16 49275 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:46:21.725464 0.219773 tcp 10.0.2.16 49276 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:46:21.946139 0.106683 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 595 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.052490 0.169168 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 320 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.053350 3.003230 tcp 10.0.2.16 49277 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:46:22.222187 0.092450 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 323 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:22.315388 0.168543 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 517 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:25.487569 0.168507 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 548 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:28.652336 0.509564 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1226 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.162516 0.276538 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1090 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.439745 0.315972 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1639 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:29.754828 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:31.055530 0.000000 tcp 10.0.2.16 49277 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 13:46:35.121455 0.168467 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 13:46:43.052908 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:48.060327 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:46:53.067457 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 13:48:45.112448 3.000282 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:48:52.118294 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:00.119988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:16.122889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:48.128513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:55:52.136646 2.999818 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:55:59.142491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:07.143787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:23.147013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:55.152572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:02:59.160109 3.000526 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:03:06.166012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:14.167774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:30.170885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:04:02.176484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:06.184356 2.999958 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:10:13.190534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:21.191966 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:37.194979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:11:09.200967 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:16:44.182533 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:16:44.182890 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:00.616332 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:13.208127 3.000280 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:17:15.682265 2.028200 tcp 10.0.2.16 49278 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:15.873844 0.228566 tcp 10.0.2.16 49279 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:16.103425 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:20.213767 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:28.215562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:33.823592 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:44.218882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:49.048096 0.192631 tcp 10.0.2.16 49280 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:49.241292 0.222168 tcp 10.0.2.16 49281 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:17:49.464350 0.090992 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 375 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.555993 0.106002 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 531 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.556529 2.994129 tcp 10.0.2.16 49282 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:17:49.661474 0.166955 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:17:49.828949 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:17:58.549157 0.000000 tcp 10.0.2.16 49282 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:18:08.265164 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:10.556380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:15.563559 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:16.224442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:18:20.570691 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:18:26.251520 0.190711 tcp 10.0.2.16 49283 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:18:26.442469 0.222236 tcp 10.0.2.16 49284 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:24:20.231906 3.000040 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:24:27.238363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:35.239376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:51.242202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:25:23.248374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:27.255997 3.000236 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:31:34.261964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:42.263952 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:58.266816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:32:30.273723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:34.280902 2.999383 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:38:41.286088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:49.287814 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:05.290768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:37.296330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:41.303483 3.000513 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:45:48.310337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:56.311757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:12.314562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:44.320448 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:48:54.698286 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:48:54.698603 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:11.011672 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:27.189262 0.191028 tcp 10.0.2.16 49285 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:49:27.380582 0.227838 tcp 10.0.2.16 49286 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:49:27.609336 4.147459 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.716229 3.722313 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1547 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.717205 2.992456 tcp 10.0.2.16 49287 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:49:27.813172 4.455540 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1671 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:27.985543 0.167151 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:32.269242 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:36.708079 0.000000 tcp 10.0.2.16 49287 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 14:49:40.193560 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:47.624197 0.167983 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 517 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:48.715685 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:50.789330 0.515618 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:51.305504 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:53.723085 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:49:57.337836 0.170897 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:49:58.730116 2.106856 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1771 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:50:00.836457 0.290087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 14:50:01.127067 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:08.263605 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:12.960414 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:50:15.194282 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:23.976722 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:31.407688 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:40.219617 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:46.779721 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:54.801033 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:50:59.456908 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:51:00.799113 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:09.231929 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:17.113247 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:51:23.832850 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 14:52:48.327665 3.000865 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 14:52:55.333899 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:03.335597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:19.338624 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:51.344647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:59:55.352252 2.999925 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:00:02.358015 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:10.359518 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:26.362498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:58.368275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:02.375826 3.000163 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:07:09.381954 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:17.383602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:33.386459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:08:05.392676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:09.400105 2.999985 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:14:16.406158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:24.407109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:40.410315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:15:12.416623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:16.423775 3.000569 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:21:23.430035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:31.431014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:46.093025 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:21:46.093364 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:21:47.434573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:22:03.868126 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:18.893709 0.190036 tcp 10.0.2.16 49288 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:19.084094 0.228142 tcp 10.0.2.16 49289 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:19.313135 0.169221 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:22:19.440134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:22:19.482950 0.107119 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:22:19.483538 3.000769 tcp 10.0.2.16 49290 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:22:19.589214 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:28.483336 0.000000 tcp 10.0.2.16 49290 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:22:37.476115 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:40.480675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:45.488354 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:50.494993 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:22:53.090923 0.192372 tcp 10.0.2.16 49291 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:53.283706 0.217576 tcp 10.0.2.16 49292 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:22:53.502197 0.092189 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 343 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:28:23.447969 2.999874 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:28:30.453938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:38.455299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:54.458555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:29:26.464159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:35:30.471898 3.000489 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:35:37.477757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:35:45.479289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:01.482062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:33.488521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:42:37.496275 2.999610 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:42:44.502079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:42:52.502825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:08.505827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:40.512035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:49:44.519378 3.000143 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:49:51.525547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:49:59.527439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:15.529778 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:47.536047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:53:09.580711 0.000183 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:53:09.581049 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:53:26.124066 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:53:45.065835 0.191857 tcp 10.0.2.16 49293 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:53:45.258153 0.222747 tcp 10.0.2.16 49294 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:53:45.481971 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:03.558013 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:19.873735 0.190445 tcp 10.0.2.16 49295 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:54:20.064603 0.223621 tcp 10.0.2.16 49296 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:54:20.289116 0.169806 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.459587 0.107577 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.460128 3.006243 tcp 10.0.2.16 49297 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:54:20.566309 0.090943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 238 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:20.657915 0.173409 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:23.827378 0.170218 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.001575 0.316363 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1577 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.317062 0.275464 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:27.593097 0.508024 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1162 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:28.101609 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:29.465282 0.000000 tcp 10.0.2.16 49297 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 15:54:35.003575 0.168017 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 15:54:41.462518 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:46.469613 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:54:51.477031 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 15:56:51.543828 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 15:56:58.549831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:06.551439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:22.554640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:54.560262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:03:58.567816 2.999716 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:04:05.573904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:13.575083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:29.578123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:05:01.584067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:05.591166 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:11:12.597567 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:20.599179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:36.601707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:12:08.608585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:12.615958 3.000172 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:18:19.621567 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:27.623246 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:43.625800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:19:15.632079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:24:45.236212 0.000175 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:24:45.236552 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:01.339820 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:19.639661 2.999739 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:25:19.870337 0.193531 tcp 10.0.2.16 49298 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:20.064301 0.235452 tcp 10.0.2.16 49299 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:20.300704 0.107127 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:20.407339 0.090273 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:20.408321 2.992363 tcp 10.0.2.16 49300 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:25:20.498120 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:26.645297 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:29.398998 0.000000 tcp 10.0.2.16 49300 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:25:34.646598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:37.761937 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:41.407032 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:46.414144 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:50.650193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:51.421453 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:25:55.819224 0.192107 tcp 10.0.2.16 49301 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:56.011714 0.223257 tcp 10.0.2.16 49302 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:25:56.236010 0.172817 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:25:56.409373 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:26:13.072406 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:26:22.655860 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:26:31.851649 0.191896 tcp 10.0.2.16 49303 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:26:32.044000 0.223289 tcp 10.0.2.16 49304 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:32:26.663112 3.000278 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:32:33.669581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:41.671040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:57.673563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:33:29.680094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:39:33.687128 3.000512 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:39:40.693747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:39:48.694852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:04.698391 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:36.703931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:40.711301 3.000493 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:46:47.717533 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:55.719491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:11.721508 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:43.727533 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:53:47.735361 3.000390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:53:54.741142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:02.742510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:18.745819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:50.752257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:56:44.155024 0.000176 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:56:44.155419 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:00.498967 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:15.735098 0.166567 tcp 10.0.2.16 49305 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:57:15.902065 0.199263 tcp 10.0.2.16 49306 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:57:16.102215 4.651478 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1994 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.208974 3.711240 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.209926 2.995203 tcp 10.0.2.16 49307 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:57:16.301902 4.132456 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1679 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:16.472463 0.175788 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 490 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:20.752881 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:25.203853 0.000000 tcp 10.0.2.16 49307 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 16:57:26.886382 0.174485 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 16:57:37.201459 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:42.208255 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 16:57:47.216026 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:00:54.759682 2.999753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 17:01:01.765555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:09.766729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:25.770117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:57.775987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:01.783204 3.000283 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:08:08.789307 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:16.790732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:32.793806 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:09:04.800030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:08.807083 3.000491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:15:15.813220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:23.815060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:39.817694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:16:11.823761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:15.831486 3.000079 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:22:22.837331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:30.838798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:46.841834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:23:18.847689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:27:59.080570 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:27:59.080891 0.091403 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 333 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:27:59.172931 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:27:59.173585 3.001326 tcp 10.0.2.16 49308 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 17:28:08.174774 0.000000 tcp 10.0.2.16 49308 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 17:28:15.163646 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:20.171079 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:25.177983 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:30.185268 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:33.658848 0.199277 tcp 10.0.2.16 49309 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:28:33.858582 0.206271 tcp 10.0.2.16 49310 -> 173.194.70.94 80 SRPA* 0 0 10 4836 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:28:34.065808 0.107568 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:28:34.180988 0.167749 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 17:28:34.349307 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:28:49.402859 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:29:04.857379 1.870941 tcp 10.0.2.16 49311 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:29:05.023657 0.202454 tcp 10.0.2.16 49312 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:29:22.855135 3.000529 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 17:29:29.860857 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:37.862410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:53.865288 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:30:25.871937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:36:29.879644 2.999596 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:36:36.884768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:36:44.886365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:00.889773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:32.895607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:43:36.903609 2.999439 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:43:43.909089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:43:51.910631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:07.913341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:39.919477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:50:43.927500 2.999495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:50:50.932818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:50:58.934551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:14.937628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:46.943743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:57:50.950967 3.000226 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:57:57.956680 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:05.958646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:21.961494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:53.967742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:59:33.674730 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:59:33.675073 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 17:59:48.867025 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:07.718337 1.909663 tcp 10.0.2.16 49313 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:00:07.884818 0.198160 tcp 10.0.2.16 49314 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:00:08.083920 4.641106 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.176361 3.771488 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.176893 2.991725 tcp 10.0.2.16 49315 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:00:08.283642 4.164058 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:08.452658 0.173744 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:12.725558 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:17.177127 0.000000 tcp 10.0.2.16 49315 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:00:19.881238 0.172622 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 600 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:00:29.175064 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:34.181627 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:00:39.189107 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:04:57.974503 3.000834 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:05:04.981002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:12.982211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:28.985158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:06:00.991208 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:04.999381 2.999596 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:12:12.005257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:20.006365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:36.019217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:13:08.025777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:12.032666 3.000197 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:19:19.039348 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:27.040373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:43.043463 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:20:15.049757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:19.056877 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:26:26.063108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:34.064355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:50.067435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:27:22.073701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:30:28.511750 0.000177 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:30:28.512093 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:30:46.066905 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:02.695075 0.167416 tcp 10.0.2.16 49316 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:02.862660 0.201027 tcp 10.0.2.16 49317 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:03.064595 0.171273 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.236468 0.092403 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 256 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.237000 2.998858 tcp 10.0.2.16 49318 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:31:03.329424 0.121427 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 661 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 18:31:03.435747 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:12.234538 0.000000 tcp 10.0.2.16 49318 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 18:31:20.957643 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:24.231866 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:29.238975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:34.245912 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 18:31:38.333865 0.166669 tcp 10.0.2.16 49319 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:31:38.500972 0.198486 tcp 10.0.2.16 49320 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:33:26.081156 2.999704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:33:33.087003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:41.088211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:57.091433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:34:29.097640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:40:33.105267 2.999599 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:40:40.110593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:40:48.112564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:04.115641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:36.121213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:40.128949 3.000177 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:47:47.134588 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:55.135900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:11.139422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:43.145610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:54:47.153134 3.000290 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:54:54.158810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:02.160470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:18.163056 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:50.169420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:01:54.176922 3.000036 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:02:01.183124 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:05.829481 0.000130 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:02:05.829806 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:09.184026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:21.231868 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:25.186950 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:37.927596 0.111754 tcp 10.0.2.16 49321 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:02:38.039738 0.148074 tcp 10.0.2.16 49322 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:02:38.189880 4.306794 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.272962 3.781185 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.273506 2.996982 tcp 10.0.2.16 49323 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:02:38.412633 3.877827 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1975 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:38.491089 0.139765 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 476 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:42.497301 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:02:47.269475 0.000000 tcp 10.0.2.16 49323 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:02:49.873656 0.143045 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 709 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:02:57.193610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:59.277952 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:03:04.283413 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:03:09.290944 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:09:01.200461 3.000833 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:09:08.206432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:17.529927 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:33.532759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:10:05.539092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:09.545945 3.001269 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:16:16.552491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:24.554144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:40.557450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:17:12.562893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:24.572414 3.000055 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:23:31.577921 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:39.579528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:55.582194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:24:27.588249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:30:54.599523 2.999655 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:31:01.605319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:09.606878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:25.609789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:57.615638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:33:00.736832 0.000158 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:33:00.737194 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:16.709688 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:33.665853 0.129783 tcp 10.0.2.16 49324 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:33:33.795789 0.150920 tcp 10.0.2.16 49325 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:33:33.947293 0.115086 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 787 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.040285 0.068056 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 324 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.040589 2.997903 tcp 10.0.2.16 49326 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:33:34.108690 0.140916 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 252 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 19:33:34.249953 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:43.047556 0.000000 tcp 10.0.2.16 49326 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 19:33:52.670922 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:33:55.054846 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:00.062168 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:05.068652 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 19:34:11.198726 0.111396 tcp 10.0.2.16 49327 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:34:11.309478 0.142836 tcp 10.0.2.16 49328 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:38:01.621094 3.002399 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 19:38:08.629148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:16.630798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:32.633536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:39:04.639361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:08.646717 3.000309 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:45:15.652855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:23.655426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:39.657144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:46:11.663634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:15.671111 3.000296 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:52:22.676616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:30.678609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:46.681216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:53:18.687987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:22.695418 2.999598 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:59:29.700827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:37.702438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:53.705490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:00:25.711750 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:04:34.289595 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:04:34.289947 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:04:52.435004 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:10.585730 0.167258 tcp 10.0.2.16 49329 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:05:10.753366 0.195826 tcp 10.0.2.16 49330 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:05:10.950457 4.649736 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1479 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.043161 3.768277 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1969 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.043880 3.002029 tcp 10.0.2.16 49331 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:05:11.148603 4.175293 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1755 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:11.321154 0.169310 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 582 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:15.600631 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:20.044482 0.000000 tcp 10.0.2.16 49331 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:05:21.657035 0.181254 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 575 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:05:32.042436 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:37.049668 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:05:42.056484 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:06:29.719326 2.999629 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 20:06:36.724890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:06:44.726315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:07:00.729475 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:07:32.735642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:36.743506 2.999810 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:13:43.748743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:51.750685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:14:07.753244 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:14:39.759578 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:43.766612 3.000855 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:20:50.772720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:58.774144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:21:14.777557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:21:46.783134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:27:50.791370 2.999336 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:27:57.796958 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:05.798684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:21.801280 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:53.807685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:34:57.814717 3.000411 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:35:04.820479 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:12.822014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:28.825097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:54.281990 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:35:54.282367 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:00.831052 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:36:12.388552 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:31.389623 0.165474 tcp 10.0.2.16 49332 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:36:31.555587 0.207867 tcp 10.0.2.16 49333 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:36:31.764403 0.167525 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 318 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:31.932571 0.092967 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 352 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:31.933131 2.997343 tcp 10.0.2.16 49334 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:36:32.026069 0.106707 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 20:36:32.131995 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:40.929068 0.000000 tcp 10.0.2.16 49334 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 20:36:48.539934 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:52.936690 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:36:57.943678 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:37:02.950671 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 20:37:05.296658 0.165404 tcp 10.0.2.16 49335 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:37:05.462572 0.200701 tcp 10.0.2.16 49336 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:42:04.838828 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 20:42:11.845004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:19.845855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:35.849524 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:43:07.855148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:11.863088 2.999893 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:49:18.868947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:26.869913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:42.873122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:50:14.879336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:18.886648 3.000288 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:56:25.892283 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:33.894148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:49.897218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:57:21.902825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:25.910638 3.000845 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:03:32.916968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:40.919412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:56.922467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:04:28.927217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:07:16.508294 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:07:16.508638 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:07:32.721598 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:07:51.252879 1.921157 tcp 10.0.2.16 49337 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:07:51.419399 0.202726 tcp 10.0.2.16 49338 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:07:51.622668 4.405090 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:51.724076 4.993702 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 5 1175 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:51.724665 2.998063 tcp 10.0.2.16 49339 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:07:51.894161 4.580014 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:52.001477 0.171067 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:56.914181 0.169259 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 3 543 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:07:57.083903 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:00.721948 0.000000 tcp 10.0.2.16 49339 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:08:02.855229 0.392553 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 613 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:08:12.718922 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:17.726388 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:08:22.733293 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:10:32.932518 3.002615 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 21:10:39.940762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:10:47.941776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:11:03.945268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:11:35.950870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:39.956923 3.001647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:17:46.964204 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:54.966204 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:18:10.968782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:18:42.974865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:24:46.980298 3.002634 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:24:53.988744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:01.989577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:17.993404 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:49.998710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:31:54.004306 3.002689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:32:01.012411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:09.013882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:25.017245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:57.023245 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:38:26.666828 0.000141 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:38:26.667188 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:38:45.353605 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:01.028753 3.001594 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:39:01.860055 1.751553 tcp 10.0.2.16 49340 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:02.036732 0.200010 tcp 10.0.2.16 49341 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:02.237251 0.106343 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.342773 0.096878 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.343062 2.999666 tcp 10.0.2.16 49342 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:39:02.439975 0.169898 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 215 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 21:39:02.610219 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:08.036009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:11.341070 0.000000 tcp 10.0.2.16 49342 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 21:39:16.038259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:18.171368 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:23.338607 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:28.345628 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:32.041197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:33.353272 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 21:39:34.315567 1.864563 tcp 10.0.2.16 49343 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:34.480799 0.197204 tcp 10.0.2.16 49344 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:40:04.046809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:08.052383 3.002088 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:46:15.060642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:23.061790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:39.064809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:47:11.071026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:15.079074 2.999445 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:53:22.084513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:30.085808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:46.088471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:54:18.095103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:22.100151 3.002051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:00:29.108321 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:37.109711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:53.112708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:01:25.118961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:29.126836 2.999912 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:07:36.132536 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:44.133587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:00.136600 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:32.142653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:09:40.571368 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:09:40.571710 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:09:58.216569 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:15.376177 1.921877 tcp 10.0.2.16 49345 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:10:15.542686 0.207565 tcp 10.0.2.16 49346 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:10:15.751219 4.651374 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1445 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:15.842824 3.769991 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2140 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:15.843654 3.002491 tcp 10.0.2.16 49347 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:10:15.949331 4.179416 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1462 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:16.122577 0.173887 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:20.403129 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:24.845266 0.000000 tcp 10.0.2.16 49347 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:10:26.107034 0.172950 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:10:36.842041 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:41.849582 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:10:46.856351 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:14:36.150329 2.999953 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:14:43.156515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:14:51.158149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:15:07.160490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:15:39.166743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:43.173914 3.000814 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:21:50.179890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:58.181523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:22:14.185531 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:22:46.190909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:28:50.196097 3.002433 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:28:57.204007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:05.205332 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:21.208385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:53.214641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:35:57.222365 2.999850 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:36:04.228309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:36:12.229295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:36:28.232701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:37:00.238726 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:40:53.604179 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:40:53.604501 0.106598 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:40:53.710399 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:40:53.711572 2.997086 tcp 10.0.2.16 49348 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:02.717395 0.000000 tcp 10.0.2.16 49348 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:12.371095 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:14.715551 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:19.721864 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:24.728824 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:29.480038 0.167093 tcp 10.0.2.16 49349 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:41:29.647628 0.200026 tcp 10.0.2.16 49350 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:41:29.848720 0.091254 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 249 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:41:29.940554 0.168408 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 404 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 22:41:29.941099 2.999460 tcp 10.0.2.16 49351 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:30.109497 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:38.939355 0.000000 tcp 10.0.2.16 49351 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 22:41:48.974210 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:50.946590 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:41:55.954040 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:42:00.961220 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 22:42:04.258124 0.166958 tcp 10.0.2.16 49352 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:42:04.425359 0.200686 tcp 10.0.2.16 49353 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:43:04.246306 2.999764 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:43:11.251800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:19.253777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:35.256753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:44:07.263009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:11.270257 2.999904 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:50:18.275800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:26.277695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:42.281040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:51:14.286773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:18.292019 3.002001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:57:25.300262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:33.301170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:49.304669 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:58:21.310170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:25.318245 3.000718 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:04:32.323709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:40.325851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:56.328230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:05:28.334255 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:32.341708 3.000785 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:11:39.348133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:47.349129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:03.352803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:23.231106 0.000185 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:12:23.231448 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:12:35.358527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:40.275762 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:12:58.727068 0.165131 tcp 10.0.2.16 49354 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:12:58.892762 0.197921 tcp 10.0.2.16 49355 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:12:59.091822 4.655716 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2088 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.196924 3.714997 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1566 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.197456 2.999241 tcp 10.0.2.16 49356 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:12:59.289807 4.139277 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:12:59.463660 0.170712 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 464 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:13:03.746620 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:08.195653 0.000000 tcp 10.0.2.16 49356 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:13:12.441997 0.172089 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:13:20.193415 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:25.200034 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:13:30.207674 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:18:39.365632 3.000449 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 23:18:46.371868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:18:54.373761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:19:10.376176 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:19:42.382631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:25:46.390321 2.999689 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:25:53.395968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:01.397376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:17.400325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:49.406505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:32:53.414018 3.000452 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:33:00.420228 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:08.421077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:24.424915 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:56.430313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:00.437782 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:40:07.443766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:15.444968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:31.448049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:41:03.454104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:43:38.657784 0.000090 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:43:38.657956 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:43:54.570719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:10.678046 0.165559 tcp 10.0.2.16 49357 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:10.843976 0.204143 tcp 10.0.2.16 49358 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:11.049128 0.169319 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.219201 0.106926 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.219835 2.998617 tcp 10.0.2.16 49359 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:44:11.325057 0.092215 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 286 flow=From-Botnet-V1-UDP-Establishedd 1970/01/01 23:44:11.417857 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:20.227289 0.000000 tcp 10.0.2.16 49359 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/01 23:44:26.596785 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:32.224714 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:37.231685 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:42.238853 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 23:44:44.293909 0.165627 tcp 10.0.2.16 49360 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:44:44.460085 0.205185 tcp 10.0.2.16 49361 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:47:07.461692 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 23:47:14.467559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:22.469170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:38.472764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:48:10.478233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:14.485983 3.000184 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:54:21.491710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:29.492975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:45.496076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:55:17.502484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:21.509635 3.000281 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:01:28.516249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:36.517173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:52.520427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:02:24.526314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:28.534128 2.999945 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:08:35.539576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:43.541516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:59.544122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:09:31.550003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:03.888332 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:15:03.888636 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:19.060016 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:35.557701 3.000208 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:15:36.860298 0.172538 tcp 10.0.2.16 49362 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:15:37.033111 0.200273 tcp 10.0.2.16 49363 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:15:37.233940 4.752895 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2086 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.446654 3.946644 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.447329 2.992963 tcp 10.0.2.16 49364 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:15:37.617345 4.051943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1463 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:37.710302 0.171132 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:41.986314 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:15:42.563551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:46.439045 0.000000 tcp 10.0.2.16 49364 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:15:50.564919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:50.785765 0.172356 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:15:58.446658 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:03.453963 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:06.567992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:16:08.461061 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:16:38.574390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:42.581903 3.000917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:22:49.588576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:57.588759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:23:13.591884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:23:45.598019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:29:49.605819 2.999686 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:29:56.611711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:04.613034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:20.615779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:52.621794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:36:56.629346 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:37:03.635325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:11.636769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:27.640094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:59.646636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:03.653202 3.000655 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:44:10.659484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:18.660779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:34.663690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:45:06.670146 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:46:06.225968 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:46:06.226272 0.171911 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 257 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:06.398805 0.091114 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 267 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:06.399732 3.000440 tcp 10.0.2.16 49365 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:46:06.490455 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:15.399394 0.000000 tcp 10.0.2.16 49365 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 00:46:23.370187 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:27.406141 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:32.413788 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:37.420965 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:41.470716 0.165363 tcp 10.0.2.16 49366 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:46:41.636589 0.197155 tcp 10.0.2.16 49367 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:46:41.834635 0.108291 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 467 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 00:46:41.942036 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:46:59.542263 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 00:47:16.519140 0.165853 tcp 10.0.2.16 49368 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:47:16.685446 0.202341 tcp 10.0.2.16 49369 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:51:10.677310 3.000216 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 00:51:17.683722 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:25.684785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:41.688159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:52:13.693935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:17.701219 3.000108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:58:24.707363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:32.708783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:48.712041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:59:20.718368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:24.725829 2.999633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:05:31.731498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:39.732892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:55.735918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:06:27.741972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:31.749487 3.000180 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:12:38.755313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:46.757053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:13:02.759873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:13:34.766254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:17:42.462595 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:17:42.462949 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:17:59.176043 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:16.205925 0.167586 tcp 10.0.2.16 49370 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:18:16.374023 0.201475 tcp 10.0.2.16 49371 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:18:16.576442 4.653258 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.753017 3.649276 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1865 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.753596 3.002086 tcp 10.0.2.16 49372 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:18:16.845992 3.879528 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1756 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:16.951857 0.171912 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:21.230237 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:25.754547 0.000000 tcp 10.0.2.16 49372 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:18:29.990586 0.170177 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:18:37.751587 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:42.759456 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:18:47.765870 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:19:38.773262 3.000726 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 01:19:45.779020 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:19:53.781187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:20:09.783913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:20:41.789685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:26:45.797929 2.999943 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:26:52.803519 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:00.804441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:16.808165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:48.813558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:33:52.820853 3.000729 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:33:59.827118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:07.828870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:23.831665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:55.838116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:40:59.845634 2.999468 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:41:06.851656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:14.852457 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:30.855999 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:42:02.861722 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:06.869414 2.999756 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:48:13.874964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:21.876771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:37.880065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:49:00.112207 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:49:00.112515 0.095879 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 246 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:00.209022 0.106586 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:00.209727 3.006060 tcp 10.0.2.16 49373 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:00.314824 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:09.214992 0.000000 tcp 10.0.2.16 49373 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:09.885917 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:49:19.239721 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:21.212672 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:26.219451 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:31.226785 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:38.170714 0.166099 tcp 10.0.2.16 49374 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:49:38.337316 0.199459 tcp 10.0.2.16 49375 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:49:38.537762 0.167908 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 01:49:38.706297 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:38.706932 2.994182 tcp 10.0.2.16 49376 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:47.699698 0.000000 tcp 10.0.2.16 49376 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 01:49:56.362963 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:49:59.707572 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:04.714397 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:09.721973 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 01:50:14.350709 0.167074 tcp 10.0.2.16 49377 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:50:14.518056 0.203573 tcp 10.0.2.16 49378 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:55:13.892944 3.000168 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 01:55:20.899431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:28.900970 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:44.903986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:56:16.909712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:20.917012 3.000956 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:02:27.924358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:35.924263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:51.927522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:03:23.933411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:27.941217 3.000332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:09:34.947139 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:42.948488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:58.951922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:10:30.958030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:34.965088 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:16:41.971019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:49.972335 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:17:05.975725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:17:37.981565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:20:39.613186 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:20:39.613535 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:20:57.789434 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:15.348655 0.167287 tcp 10.0.2.16 49379 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:21:15.516419 0.198182 tcp 10.0.2.16 49380 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:21:15.715679 4.677854 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1575 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:15.812558 3.774173 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2028 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:15.813098 2.996559 tcp 10.0.2.16 49381 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:21:15.918477 4.185689 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1407 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:16.092197 0.168846 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 476 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:20.394082 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:24.818050 0.000000 tcp 10.0.2.16 49381 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:21:26.540593 0.170841 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:21:36.825256 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:41.832372 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:21:46.839620 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:23:41.988940 2.999978 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 02:23:48.994723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:23:56.996279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:24:12.999687 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:24:45.005389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:30:49.013069 3.000268 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:30:56.018871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:04.020643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:20.023797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:52.029771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:37:56.037567 2.999370 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:38:03.042840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:11.044756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:27.047411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:59.053667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:03.060800 3.000012 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:45:10.066569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:18.068145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:34.071081 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:46:06.077992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:51:36.713777 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:51:36.714085 0.111322 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 416 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:51:36.824883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:51:36.826022 3.000960 tcp 10.0.2.16 49382 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:51:45.825595 0.000000 tcp 10.0.2.16 49382 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:51:55.640462 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:51:57.823216 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:02.830702 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:07.837444 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:10.084892 3.000440 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 02:52:12.509300 0.171213 tcp 10.0.2.16 49383 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:12.680892 0.200650 tcp 10.0.2.16 49384 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:12.882451 0.091608 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:52:12.974656 0.167996 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 319 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 02:52:12.975458 2.994109 tcp 10.0.2.16 49385 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:52:13.143378 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:17.091053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:21.977543 0.000000 tcp 10.0.2.16 49385 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 02:52:25.092155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:28.517754 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:33.985937 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:38.992636 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:41.095751 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:43.999632 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 02:52:47.226122 0.216884 tcp 10.0.2.16 49386 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:52:47.443440 0.249182 tcp 10.0.2.16 49387 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:53:13.101103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:17.108858 3.000329 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:59:24.115710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:32.116748 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:48.120118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:00:20.125295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:24.132471 3.000257 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:06:31.138878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:39.140024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:55.143443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:07:27.149232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:31.156965 3.000082 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:13:38.162804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:46.164481 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:02.166982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:34.173043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:38.180899 3.000073 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:20:45.186480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:53.188512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:21:09.191346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:21:41.197035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:23:01.693630 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:23:01.693963 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:20.610552 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:38.460266 0.250073 tcp 10.0.2.16 49388 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:23:38.710770 0.235179 tcp 10.0.2.16 49389 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:23:38.946932 4.760435 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2244 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.058780 3.769250 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1681 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.059815 3.000895 tcp 10.0.2.16 49390 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:23:39.161703 4.211429 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:39.343800 0.173885 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:23:43.706334 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:23:48.059637 0.000000 tcp 10.0.2.16 49390 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:23:52.175571 0.180244 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:24:00.067718 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:24:05.074447 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:24:10.081847 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:27:45.204906 2.999667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 03:27:52.210894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:00.212458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:16.215107 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:48.221214 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:34:52.228422 3.000609 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:34:59.234512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:07.236608 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:23.239604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:55.245696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:41:59.252969 3.000174 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:42:06.258526 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:14.260257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:30.262818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:43:02.268929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:06.276910 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:49:13.282577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:21.283833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:37.287048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:50:09.293117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:54:21.245705 0.000136 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:54:21.246009 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:54:37.388920 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:54:55.860148 0.178530 tcp 10.0.2.16 49391 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:54:56.039102 0.220594 tcp 10.0.2.16 49392 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:54:56.260746 0.172632 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 290 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.433937 0.112011 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 496 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.434550 2.985844 tcp 10.0.2.16 49393 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:54:56.546325 0.097863 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 03:54:56.644729 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:05.418666 0.000000 tcp 10.0.2.16 49393 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 03:55:14.371694 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:17.426090 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:22.433270 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:27.440864 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 03:55:30.887982 1.895032 tcp 10.0.2.16 49394 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:55:31.066444 0.214491 tcp 10.0.2.16 49395 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:56:13.300830 3.000343 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 03:56:20.306244 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:28.308062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:44.311222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:57:16.316836 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:20.324340 3.000318 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:03:27.330955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:35.332405 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:51.335360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:04:23.341075 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:27.348689 3.000042 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:10:34.354586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:42.355889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:58.358984 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:11:30.365181 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:34.372798 3.000036 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:17:41.378311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:49.380008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:18:05.382837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:18:37.389282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:41.396528 3.000249 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:24:48.402530 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:56.403914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:12.406776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:44.413268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:48.318651 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:25:48.318993 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:05.163013 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:20.769744 0.198421 tcp 10.0.2.16 49396 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:26:20.968508 0.238589 tcp 10.0.2.16 49397 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:26:21.208217 4.884198 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2426 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.339712 4.039729 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1617 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.340255 3.000186 tcp 10.0.2.16 49398 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:26:21.526149 4.174952 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1512 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:21.634390 0.184076 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:26.091916 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:30.339082 0.000000 tcp 10.0.2.16 49398 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:26:32.642870 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:37.809735 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:42.346940 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:44.780138 0.183423 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 422 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:47.353880 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:47.964554 0.554489 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:26:48.519793 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:52.361071 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:26:56.877152 0.184874 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 487 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.062072 0.378336 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1801 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.439953 0.314127 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1288 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:27:00.440958 3.005261 tcp 10.0.2.16 49399 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:27:00.754620 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:04.598185 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:27:09.274860 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:09.444807 0.000000 tcp 10.0.2.16 49399 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:27:18.198124 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:21.442417 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:26.449768 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:26.479870 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:31.457222 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:34.040617 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:41.812225 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:46.598374 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:27:48.731931 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:27:55.100865 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:01.109650 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:07.949580 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:15.660894 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:28:22.121320 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:31:48.420309 3.000078 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 04:31:55.426671 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:03.428064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:19.431147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:51.436961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:38:55.444191 3.000707 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:39:02.450043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:10.452283 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:26.454694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:58.461292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:02.468772 3.000052 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:46:09.474677 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:17.475898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:33.479101 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:47:05.484563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:09.492469 3.000387 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:53:16.498358 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:24.499830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:40.503050 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:54:12.508906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:58:59.752307 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:58:59.752620 0.178030 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:58:59.931071 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:58:59.931981 3.004368 tcp 10.0.2.16 49400 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:59:08.935158 0.000000 tcp 10.0.2.16 49400 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 04:59:15.664861 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:20.933107 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:25.939556 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:30.947391 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:32.763899 0.203392 tcp 10.0.2.16 49401 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:59:32.967729 0.224396 tcp 10.0.2.16 49402 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:59:33.193051 0.138216 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 04:59:33.330250 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 04:59:52.037266 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:10.045358 0.202082 tcp 10.0.2.16 49403 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:00:10.247951 0.207431 tcp 10.0.2.16 49404 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:00:10.456322 0.101863 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 387 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:00:10.559104 2.989180 tcp 10.0.2.16 49405 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:00:16.516492 3.000121 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:00:19.556774 0.000000 tcp 10.0.2.16 49405 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:00:23.522411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:31.523653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:31.553983 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:36.561178 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:41.568756 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:00:47.526904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:01:19.532882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:23.540597 2.999599 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:07:30.546462 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:38.547794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:54.550803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:08:26.556478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:30.564593 2.999807 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:14:37.570051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:45.571413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:15:01.574949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:15:33.580747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:37.588146 3.000374 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:21:44.593846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:52.595388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:22:08.598974 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:22:40.604762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:44.612212 3.000162 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:28:51.618221 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:59.619791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:29:15.622617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:29:47.628911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:30:31.241816 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:30:31.242159 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:30:47.635030 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:03.422005 0.179280 tcp 10.0.2.16 49406 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:03.601689 0.236809 tcp 10.0.2.16 49407 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:03.839607 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:20.582156 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:36.417453 0.202863 tcp 10.0.2.16 49408 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:36.620154 0.252063 tcp 10.0.2.16 49409 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:31:36.873140 0.178703 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.052492 0.126154 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.053042 2.997668 tcp 10.0.2.16 49410 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:31:37.177773 0.097016 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:37.275743 0.180303 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 627 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:40.451565 0.171462 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 606 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:43.625578 0.360295 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1265 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:43.985511 0.292446 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:44.278458 0.538260 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1357 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:44.817208 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:31:46.048877 0.000000 tcp 10.0.2.16 49410 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 05:31:49.934914 0.174416 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 05:31:58.056579 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:32:03.063895 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:32:08.070521 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 05:35:51.636304 2.999697 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:35:58.642004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:06.643453 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:22.646640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:54.652298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:42:58.660489 2.999722 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:43:05.666305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:13.667365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:29.670421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:44:01.676451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:05.683938 3.000465 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:50:12.689945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:20.692003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:36.694249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:51:08.700338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:12.708173 2.999903 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:57:19.713645 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:27.715667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:43.718843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:58:15.724891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:01:58.394956 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:01:58.395499 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:17.101452 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:32.738880 2.462554 tcp 10.0.2.16 49411 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:02:33.394674 0.804652 tcp 10.0.2.16 49412 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:02:34.200279 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:02:50.649719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:08.117897 0.467574 tcp 10.0.2.16 49413 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:08.585718 0.541342 tcp 10.0.2.16 49414 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:09.128004 0.298369 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 399 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:09.427079 0.271547 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 653 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:09.427655 2.993105 tcp 10.0.2.16 49415 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:03:09.697995 0.323673 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:03:10.022177 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:18.419342 0.000000 tcp 10.0.2.16 49415 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:03:28.874620 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:30.426940 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:35.434831 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:40.441344 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:03:46.452404 0.671179 tcp 10.0.2.16 49416 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:03:47.123946 0.811502 tcp 10.0.2.16 49417 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:04:19.732510 2.999826 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 06:04:26.737601 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:34.739368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:50.742259 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:05:22.748189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:26.756151 3.000083 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:11:33.762180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:41.763569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:57.766196 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:12:29.772310 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:33.780447 2.999941 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:18:40.785982 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:48.787759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:19:04.790753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:19:36.796704 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:40.803853 3.000434 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:25:47.809896 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:55.811725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:26:11.814276 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:26:43.820475 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:32:47.827923 3.000279 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:32:54.833710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:02.835455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:18.838484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:50.844714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:34:10.573071 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:34:10.573437 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:29.150004 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:46.619407 0.597050 tcp 10.0.2.16 49418 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:34:47.216915 0.644904 tcp 10.0.2.16 49419 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:34:47.862808 0.313400 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:48.176858 4.731937 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2084 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:48.177416 2.993652 tcp 10.0.2.16 49420 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:34:48.636605 4.927707 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1325 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:49.176986 0.398499 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 634 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:52.907879 0.297986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1151 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:34:53.740931 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:53.741466 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:34:57.169305 0.000000 tcp 10.0.2.16 49420 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 06:34:59.052656 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:05.942678 0.221204 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:09.167669 0.586154 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1143 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:09.177463 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:09.754376 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:14.184340 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:17.930138 0.221821 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:19.191995 2.589430 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1608 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:21.154558 0.335622 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1493 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 06:35:21.781994 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:28.214627 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:33.101655 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:35:34.964183 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:42.925364 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:48.483858 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:35:55.443994 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:02.794592 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:08.793790 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:14.000344 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:18.606775 0.000197 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:36:22.171801 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:30.794424 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:36:36.502872 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 06:39:54.851459 3.000710 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 06:40:01.857781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:09.859433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:25.862615 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:57.868442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:01.875638 3.000291 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:47:08.882093 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:16.883384 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:32.886236 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:48:04.892467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:08.899779 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:54:15.906045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:23.907498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:39.910359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:55:11.917592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:15.924892 2.998703 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:01:22.929850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:30.930911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:46.934209 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:02:18.940069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:07:10.609938 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:07:10.610254 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:25.661335 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:43.010416 0.551124 tcp 10.0.2.16 49421 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:07:43.561791 0.849383 tcp 10.0.2.16 49422 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:07:44.412210 0.333658 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 309 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:07:44.746486 0.112408 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 545 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:07:44.747043 2.995865 tcp 10.0.2.16 49423 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:07:44.857964 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:07:53.741849 0.000000 tcp 10.0.2.16 49423 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:08:03.516179 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:05.739099 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:10.746581 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:15.753157 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:08:19.540939 0.203576 tcp 10.0.2.16 49424 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:08:19.745023 0.232427 tcp 10.0.2.16 49425 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:08:19.978334 0.102099 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 248 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:08:22.947967 2.999768 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:08:29.953279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:37.954829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:53.958410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:09:25.963847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:29.971670 3.000545 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:15:36.977761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:44.978755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:16:00.981800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:16:32.987847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:36.995439 3.000027 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:22:44.001690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:52.002922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:23:08.005981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:23:40.011790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:44.019518 3.000234 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:29:51.025311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:59.027355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:30:15.029698 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:30:47.036175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:36:51.043645 3.000233 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:36:58.049502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:06.051479 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:22.054269 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:54.059894 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:38:43.902006 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:38:43.902325 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:38:58.923618 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:14.150075 0.537604 tcp 10.0.2.16 49426 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:14.688139 0.548177 tcp 10.0.2.16 49427 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:15.237542 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:31.459919 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:47.825819 0.508386 tcp 10.0.2.16 49428 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:48.334801 0.485300 tcp 10.0.2.16 49429 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:48.821065 0.419193 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.240885 0.258869 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.241481 2.998752 tcp 10.0.2.16 49430 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:39:49.499402 0.274194 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:49.774279 0.384812 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 478 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:53.161534 0.327173 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 498 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:56.486184 0.333593 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:56.819469 0.803783 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:57.623796 0.295731 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1330 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:39:57.920060 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:39:58.238431 0.000000 tcp 10.0.2.16 49430 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 07:40:04.978694 0.333320 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 07:40:10.246234 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:40:15.253540 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:40:20.260697 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 07:43:58.067268 3.000146 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:44:05.073327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:13.075083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:29.077942 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:45:01.084294 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:05.091588 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:51:12.097797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:20.098810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:36.101597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:52:08.107741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:12.116000 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:58:19.121605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:27.122551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:43.125560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:59:15.131797 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:19.139537 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:05:26.145702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:34.147072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:50.149772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:06:22.156291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:10:31.524559 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:10:31.524925 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:10:48.689174 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:07.681232 0.228445 tcp 10.0.2.16 49431 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:07.910077 0.212883 tcp 10.0.2.16 49432 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:08.123916 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:26.293411 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:44.230930 0.178545 tcp 10.0.2.16 49433 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:44.409990 0.211465 tcp 10.0.2.16 49434 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:11:44.622343 0.270457 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:44.893395 0.112353 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:44.893950 2.999880 tcp 10.0.2.16 49435 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:11:45.004596 0.096929 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:11:45.102067 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:11:53.893082 0.000000 tcp 10.0.2.16 49435 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:12:00.762851 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:05.890561 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:10.897534 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:15.904706 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:12:19.492145 0.202019 tcp 10.0.2.16 49436 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:12:19.694681 0.229747 tcp 10.0.2.16 49437 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:12:26.163377 3.000057 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:12:33.169350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:41.170660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:57.173634 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:13:29.179684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:33.187527 2.999758 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:19:40.192987 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:48.194981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:20:04.197665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:20:36.203741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:40.211356 3.000041 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:26:47.217320 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:55.218914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:27:11.221815 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:27:43.227906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:33:47.235446 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:33:54.240852 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:02.242378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:18.245901 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:50.251880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:40:54.259119 3.000385 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:41:01.265175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:09.267041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:25.269794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:57.275712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:42:23.323660 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:42:23.324002 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:42:40.167818 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:42:57.697839 0.177915 tcp 10.0.2.16 49438 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:42:57.876044 0.213548 tcp 10.0.2.16 49439 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:42:58.090482 4.993203 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1113 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.201956 4.478223 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.202486 2.995204 tcp 10.0.2.16 49440 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:42:58.476829 4.496255 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:42:58.574961 0.280565 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:03.195761 0.111637 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 909 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:03.306857 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:07.195942 0.000000 tcp 10.0.2.16 49440 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 08:43:08.718592 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:16.930763 0.273100 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:19.193772 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:20.205366 0.820389 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:21.026427 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:24.200980 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:26.263655 0.276728 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 692 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:29.207872 0.664654 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1870 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:29.871796 0.293937 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1247 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 08:43:30.166308 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:38.331788 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:43.098345 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:43:46.262473 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:52.391330 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:43:58.289992 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:04.318774 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:11.999372 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:19.510323 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:26.109814 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:31.096622 0.000162 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:44:33.019818 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:40.831506 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:44:45.857961 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 08:48:01.283390 3.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:48:08.288805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:16.290548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:32.294007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:49:04.300086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:08.306820 3.000702 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:55:15.312777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:23.314447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:39.317546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:56:11.323884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:15.331157 3.000304 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:02:22.337083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:30.338757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:46.341759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:03:18.347420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:22.354791 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:09:29.360736 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:37.362617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:53.365512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:10:25.371661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:14:57.062196 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:14:57.062536 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:15.378838 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:31.045489 0.199279 tcp 10.0.2.16 49441 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:15:31.245024 0.213055 tcp 10.0.2.16 49442 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:15:31.459021 0.280833 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:15:31.740459 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:31.741030 3.004960 tcp 10.0.2.16 49443 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:15:40.745462 0.000000 tcp 10.0.2.16 49443 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:15:48.436523 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:52.742543 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:15:57.750091 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:16:02.756577 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:16:07.084875 0.177837 tcp 10.0.2.16 49444 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:16:07.263033 0.209425 tcp 10.0.2.16 49445 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:16:07.473433 0.097988 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 278 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:16:07.571950 0.111898 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:16:29.378752 3.000906 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:16:36.384643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:16:44.386886 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:17:00.389476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:17:32.395343 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:36.403097 3.000324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:23:43.408949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:51.410521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:24:07.413145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:24:39.419843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:43.427378 2.999511 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:30:50.432878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:58.434712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:31:14.437560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:31:46.443635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:37:50.451580 2.999820 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:37:57.456659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:05.458686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:21.461945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:53.467930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:44:57.474998 3.000390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:45:04.480983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:12.482548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:28.485873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:46:00.491632 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:46:25.208395 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:46:25.208733 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:46:41.240385 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:46:57.367814 0.177976 tcp 10.0.2.16 49446 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:46:57.546061 0.212340 tcp 10.0.2.16 49447 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:46:57.759538 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:13.135705 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:29.531165 0.178193 tcp 10.0.2.16 49448 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:47:29.709197 0.209784 tcp 10.0.2.16 49449 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:47:29.920067 0.273784 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.194438 0.113054 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.195062 2.999940 tcp 10.0.2.16 49450 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:47:30.306308 0.096986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 277 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:30.403958 0.279865 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 710 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:33.685863 0.270588 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 445 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:36.959953 0.334494 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:37.294104 0.290239 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1393 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:37.584857 0.833038 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:38.418385 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:39.193206 0.000000 tcp 10.0.2.16 49450 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 09:47:43.650140 0.270717 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 581 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 09:47:51.190785 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:47:56.198062 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:48:01.205264 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 09:52:04.498594 3.000501 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:52:11.504562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:19.506636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:35.509569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:53:07.515557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:11.522473 3.000322 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:59:18.528666 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:26.530130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:42.533163 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:00:14.539120 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:18.547119 3.000033 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:06:25.552864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:33.554232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:49.557365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:07:21.563380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:25.570428 3.000421 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:13:32.576357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:40.578801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:56.581783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:14:28.587456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:18:03.606560 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:18:03.606851 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:22.173325 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:41.075121 0.178054 tcp 10.0.2.16 49451 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:18:41.252994 0.212187 tcp 10.0.2.16 49452 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:18:41.466147 0.112210 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 630 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:18:41.577650 0.097615 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:18:41.578773 3.006981 tcp 10.0.2.16 49453 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:18:41.675786 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:18:50.583873 0.000000 tcp 10.0.2.16 49453 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:18:57.493742 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:02.581449 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:07.588284 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:12.595853 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:14.760789 0.178573 tcp 10.0.2.16 49454 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:14.939798 0.209304 tcp 10.0.2.16 49455 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:15.150073 0.266303 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 330 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:19:15.416914 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:33.785976 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:19:52.565846 0.178027 tcp 10.0.2.16 49456 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:19:52.744211 0.206503 tcp 10.0.2.16 49457 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:20:32.594685 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:20:39.600960 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:20:47.602264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:21:03.605285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:21:35.611402 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:39.618626 3.000192 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:27:46.624855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:54.626268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:28:10.629051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:28:42.634902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:34:46.643137 2.999385 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:34:53.648646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:01.649953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:17.653119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:49.659049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:41:53.666777 2.999848 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:42:00.672940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:08.674043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:24.677403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:56.683621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:00.690693 3.000445 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:49:07.696467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:15.697801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:31.701200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:50:03.497372 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:50:03.497664 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:03.706782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:50:22.053942 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:40.694903 0.179183 tcp 10.0.2.16 49458 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:50:40.874613 0.208988 tcp 10.0.2.16 49459 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:50:41.084527 4.751286 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.196539 3.766695 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.197530 3.007695 tcp 10.0.2.16 49460 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:50:41.296835 4.203173 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:41.487913 0.178154 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 528 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:50:45.835360 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:50.203570 0.000000 tcp 10.0.2.16 49460 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:50:52.587772 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:50:59.837813 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:02.201439 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:06.317895 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:07.208763 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:12.215630 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:14.479161 0.175374 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 447 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:17.653661 0.538909 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1095 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:18.193290 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:18.193842 2.994650 tcp 10.0.2.16 49461 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:51:22.600782 0.000154 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:51:26.957081 0.173971 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 543 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:27.197065 0.000000 tcp 10.0.2.16 49461 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 10:51:30.131435 0.334744 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:30.465850 0.291267 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 10:51:30.757720 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:38.574026 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:39.194904 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:43.821215 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:44.201581 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:48.918914 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:49.209403 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:51:55.407713 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:03.529751 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:08.096128 0.000112 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:52:09.809104 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:15.436422 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:22.166464 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:30.528442 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:38.229197 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:45.510168 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 10:52:50.096035 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:56:07.714329 3.000310 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:56:14.720159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:22.721834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:38.724720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:57:10.730932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:14.738167 3.000799 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:03:21.744681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:29.745916 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:45.748855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:04:17.755092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:21.762577 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:10:28.768627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:36.769763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:52.772669 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:11:24.778732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:28.786714 3.000088 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:17:35.792467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:43.794301 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:59.796777 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:18:31.802619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:23:11.085077 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:23:11.085375 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:29.111357 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:46.399842 1.739186 tcp 10.0.2.16 49462 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:23:46.577723 0.205426 tcp 10.0.2.16 49463 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:23:46.784195 0.173658 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 323 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:23:46.958464 0.114079 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 691 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:23:46.959050 3.001724 tcp 10.0.2.16 49464 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:23:47.071736 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:23:55.959440 0.000000 tcp 10.0.2.16 49464 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:24:04.531197 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:07.966741 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:12.974057 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:17.980997 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:24:22.439594 0.179197 tcp 10.0.2.16 49465 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:24:22.619315 0.212582 tcp 10.0.2.16 49466 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:24:22.832837 0.096739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:24:35.811030 2.999237 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 11:24:42.816351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:24:50.817765 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:25:06.821275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:25:38.827226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:42.834566 3.000172 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:31:49.840621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:57.841489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:32:13.844863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:32:45.850822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:38:49.858291 3.000623 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:38:56.864487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:04.865525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:20.868961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:52.874977 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:45:56.882398 3.000423 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:46:03.888087 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:11.890080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:27.892782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:59.898654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:03.906145 3.000601 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:53:10.913599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:18.914779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:34.918034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:54:06.923069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:54:39.319782 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:54:39.320098 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:54:57.796525 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:13.993913 0.176829 tcp 10.0.2.16 49467 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:14.171234 0.217071 tcp 10.0.2.16 49468 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:14.389239 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:30.864023 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:48.080315 0.178482 tcp 10.0.2.16 49469 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:48.259077 0.209770 tcp 10.0.2.16 49470 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:55:48.469853 0.244620 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.715060 0.112098 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.715674 2.997592 tcp 10.0.2.16 49471 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:55:48.826308 0.098292 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:48.925274 0.270666 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 561 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:52.194125 0.263058 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 437 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:55.458702 0.773090 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.232364 0.294768 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.527670 0.333201 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:55:56.860299 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 312 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:55:57.711824 0.000000 tcp 10.0.2.16 49471 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 11:56:04.832185 0.266506 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 530 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 11:56:09.709939 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:56:14.716524 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 11:56:19.724113 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:00:10.930569 3.000175 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:00:17.936370 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:25.937928 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:41.940786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:01:13.946747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:17.954517 3.000140 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:07:24.960165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:32.961451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:48.964477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:08:20.971290 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:24.978801 3.000704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:14:31.985041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:39.985707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:55.988769 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:15:27.994339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:32.002012 3.000551 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:21:39.007782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:47.009470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:22:03.012667 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:22:35.018625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:26:22.636462 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:26:22.636758 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:26:38.649086 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 137 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:26:54.455936 0.177784 tcp 10.0.2.16 49472 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:26:54.634120 0.210304 tcp 10.0.2.16 49473 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:26:54.845343 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:10.265060 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:28.663454 0.179576 tcp 10.0.2.16 49474 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:27:28.843391 0.210591 tcp 10.0.2.16 49475 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:27:29.054885 0.098113 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.153603 0.188361 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.154143 3.001761 tcp 10.0.2.16 49476 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:27:29.342474 0.113383 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:27:29.454701 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:38.154294 0.000000 tcp 10.0.2.16 49476 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:27:45.465272 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:50.152547 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:27:55.159622 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:28:00.166002 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:28:02.181450 0.178814 tcp 10.0.2.16 49477 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:28:02.360780 0.204536 tcp 10.0.2.16 49478 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:28:39.025876 3.000238 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:28:46.032014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:28:54.033940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:29:10.037035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:29:42.043057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:35:46.049864 3.000550 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:35:53.055947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:01.057804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:17.060474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:49.066903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:42:53.074466 2.999413 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:43:00.080058 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:08.081433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:24.084729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:56.090858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:00.097697 3.000776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:50:07.103904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:15.105164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:31.108895 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:51:03.115143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:07.122880 2.999633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:57:14.128258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:22.129112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:38.132823 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:58:10.138142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:58:31.529968 0.000166 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:58:31.530283 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:58:46.921930 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:04.961593 0.178312 tcp 10.0.2.16 49479 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:59:05.139726 0.210979 tcp 10.0.2.16 49480 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:59:05.351668 4.715908 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.528247 3.676170 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1386 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.528784 3.003837 tcp 10.0.2.16 49481 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:59:05.625302 3.913843 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1934 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:05.736872 0.173641 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:10.068076 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:14.530733 0.000000 tcp 10.0.2.16 49481 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 12:59:16.894917 0.175968 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 512 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 12:59:26.538622 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:31.545942 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 12:59:36.552929 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:04:14.145699 3.000153 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:04:21.152048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:29.153629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:45.156464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:05:17.162776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:21.169888 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:11:28.175549 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:36.177010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:52.180540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:12:24.186535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:28.194166 2.999773 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:18:35.199566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:43.201144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:59.204345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:19:31.210519 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:35.218204 2.999667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:25:42.223506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:50.225712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:26:06.228427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:26:38.234560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:29:41.418532 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:29:41.418876 0.097699 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 352 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:29:41.517192 0.112999 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 622 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:29:41.517876 2.994394 tcp 10.0.2.16 49482 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 13:29:41.629021 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:29:50.510890 0.000000 tcp 10.0.2.16 49482 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 13:29:57.450769 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:02.518363 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:07.525274 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:12.533011 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:15.550912 0.178748 tcp 10.0.2.16 49483 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:15.730003 0.205963 tcp 10.0.2.16 49484 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:15.936883 0.173546 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 360 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 13:30:16.110973 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:32.802009 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 13:30:50.349515 0.177063 tcp 10.0.2.16 49485 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:30:50.527106 0.206115 tcp 10.0.2.16 49486 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:32:42.241425 3.000813 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:32:49.247710 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:32:57.249366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:33:13.252327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:33:45.258741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:39:49.266360 3.000146 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:39:56.272074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:04.273665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:20.276471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:52.282024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:46:56.289862 2.999776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:47:03.295790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:11.297235 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:27.300302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:59.306360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:03.313852 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:54:10.319353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:18.321123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:34.324086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:55:06.330075 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:10.053718 0.000185 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:01:10.054082 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:10.338113 3.000272 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:01:17.343949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:25.344789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:26.036055 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:41.347881 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:42.023528 0.178406 tcp 10.0.2.16 49487 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:01:42.202331 0.209383 tcp 10.0.2.16 49488 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:01:42.412648 4.210943 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1458 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.514837 3.804659 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.515413 2.998938 tcp 10.0.2.16 49489 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:01:42.636978 4.517362 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1695 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:42.814634 0.173149 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:01:47.154858 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:01:51.512422 0.000000 tcp 10.0.2.16 49489 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:01:54.957645 0.178315 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:02:03.510316 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:02:08.517401 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:02:13.354564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:02:13.524277 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:08:17.361349 3.000552 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:08:24.367959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:32.369278 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:48.372059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:09:20.378412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:24.385309 3.000546 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:15:31.391349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:39.393104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:55.396572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:16:27.402162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:31.409419 2.999986 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:22:38.416053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:46.416727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:23:02.420122 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:23:34.425791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:38.433525 3.000002 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:29:45.439189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:53.441120 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:30:09.443691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:30:41.449691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:32:05.421055 0.000180 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:32:05.421397 0.112579 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 488 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:05.533475 0.097654 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 310 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:05.534651 3.000303 tcp 10.0.2.16 49490 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:32:05.631788 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:14.534142 0.000000 tcp 10.0.2.16 49490 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 14:32:21.684199 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:26.531512 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:31.538727 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:36.545760 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:38.923346 2.074809 tcp 10.0.2.16 49491 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:32:39.101998 0.214718 tcp 10.0.2.16 49492 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:32:39.317621 0.177913 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 241 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 14:32:39.496066 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:32:58.347110 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 14:33:14.001843 0.177749 tcp 10.0.2.16 49493 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:33:14.180080 0.207223 tcp 10.0.2.16 49494 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:36:45.457509 3.000050 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 14:36:52.463559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:00.464676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:16.468215 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:48.474166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:43:52.481209 3.000691 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:43:59.487460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:07.489059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:23.491868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:55.498147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:50:59.505818 3.000095 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:51:06.511145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:14.513121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:30.515783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:52:02.521863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:06.529115 3.000660 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:58:13.535357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:21.537227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:37.540166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:59:09.546055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:03:17.502599 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:03:17.502922 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:34.356522 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:49.573535 0.178721 tcp 10.0.2.16 49495 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:03:49.752515 0.207930 tcp 10.0.2.16 49496 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:03:49.961393 4.762511 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2032 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.072936 3.767430 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1623 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.074009 2.999804 tcp 10.0.2.16 49497 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:03:50.175753 4.214352 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1495 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:50.359344 0.178894 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:03:54.723433 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:03:59.071768 0.000000 tcp 10.0.2.16 49497 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:03:59.773031 0.177598 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:04:11.069776 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:04:16.076905 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:04:21.083954 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:05:13.553302 3.000102 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 15:05:20.559683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:28.561121 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:44.564168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:06:16.569759 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:20.577203 3.000450 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:12:27.583383 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:35.584905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:51.587833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:13:23.593482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:27.600825 3.000974 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:19:34.606931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:42.608445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:58.611566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:20:30.618115 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:34.625577 3.000380 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:26:41.630851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:49.632834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:05.635945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:37.642271 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:41.648806 3.000667 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:33:48.654919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:56.656699 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:12.659681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:12.960316 0.000158 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:34:12.960623 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:28.503031 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:44.509952 0.176777 tcp 10.0.2.16 49498 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:34:44.665793 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:44.687106 0.207891 tcp 10.0.2.16 49499 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:34:44.896164 0.172564 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.069335 0.111971 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 522 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.069893 3.000500 tcp 10.0.2.16 49500 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:34:45.180537 0.099035 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 283 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 15:34:45.280096 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:34:54.068987 0.000000 tcp 10.0.2.16 49500 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 15:35:03.052188 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:06.077031 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:11.083667 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:16.091171 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 15:35:20.389414 0.187782 tcp 10.0.2.16 49501 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:35:20.577731 0.209881 tcp 10.0.2.16 49502 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:40:48.672936 3.000660 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:40:55.678868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:03.680893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:19.683653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:51.689592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:47:55.696939 3.000898 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:48:02.703031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:10.704945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:26.707907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:58.713811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:02.721199 3.000162 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:55:09.726861 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:17.728870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:33.731302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:56:05.737291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:09.745149 3.000130 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:02:16.750783 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:24.752792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:40.755521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:03:12.761356 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:05:21.226418 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:05:21.226757 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:05:38.741550 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:05:56.431497 0.177557 tcp 10.0.2.16 49503 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:05:56.609318 0.211318 tcp 10.0.2.16 49504 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:05:56.821601 4.716286 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2398 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:56.934139 3.973506 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:56.935144 2.986617 tcp 10.0.2.16 49505 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:05:57.107106 4.095812 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1623 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:05:57.206943 0.172563 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:06:01.537427 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:05.920571 0.000000 tcp 10.0.2.16 49505 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:06:09.205146 0.173740 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 441 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:06:17.927654 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:22.935588 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:06:27.942591 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:09:16.769071 2.999958 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:09:23.775416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:31.776421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:47.779380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:10:19.785249 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:23.793127 3.000094 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:16:30.799388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:38.800328 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:54.803678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:17:26.809183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:30.816479 3.000360 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:23:37.822676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:45.824556 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:24:01.827389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:24:33.833664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:37.841278 3.000178 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:30:44.847378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:52.848541 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:31:08.851867 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:31:40.857118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:36:42.000899 0.000191 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:36:42.001278 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:36:59.826795 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:16.224339 0.177810 tcp 10.0.2.16 49506 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:16.402590 0.205988 tcp 10.0.2.16 49507 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:16.609559 0.099522 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.709681 0.113743 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 773 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.710219 2.993987 tcp 10.0.2.16 49508 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:37:16.822507 0.174790 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 16:37:16.997815 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:25.703298 0.000000 tcp 10.0.2.16 49508 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 16:37:32.743719 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:37.701323 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:42.708251 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:44.864961 3.000081 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:37:47.715503 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 16:37:48.037380 0.177448 tcp 10.0.2.16 49509 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:48.215066 0.203544 tcp 10.0.2.16 49510 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:37:51.871451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:37:59.872785 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:38:15.875373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:38:47.881718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:44:51.888980 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:44:58.895046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:06.896053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:22.899633 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:54.905175 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:51:58.914204 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:52:05.919366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:13.920394 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:29.923410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:53:01.929309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:05.936880 3.000011 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:59:12.942652 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:20.944590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:36.947412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:00:08.953143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:12.960660 3.000135 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:06:19.966598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:27.968198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:43.971487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:07:15.977367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:08:15.914451 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:08:15.914808 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:32.187080 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:47.433657 0.176739 tcp 10.0.2.16 49511 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:08:47.610815 0.208032 tcp 10.0.2.16 49512 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:08:47.819925 4.745635 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1612 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:47.920446 3.815073 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2141 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:47.920984 3.002427 tcp 10.0.2.16 49513 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:08:48.031666 4.235924 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:48.211191 0.178902 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 487 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:08:52.566098 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:08:56.922365 0.000000 tcp 10.0.2.16 49513 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:08:59.406424 0.177328 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:09:08.920256 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:09:13.926952 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:09:18.933981 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:13:19.985137 3.000112 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:13:26.991063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:34.992363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:50.995212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:14:23.000910 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:27.008901 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:20:34.014701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:42.016447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:58.019434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:21:30.025312 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:34.032607 3.000219 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:27:41.038268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:49.040240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:28:05.043609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:28:37.049307 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:41.056573 3.000645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:34:48.062628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:56.064361 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:35:12.067216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:35:44.073000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:39:31.580540 0.000182 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:39:31.580906 0.114182 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:39:31.694543 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:31.695972 2.999014 tcp 10.0.2.16 49514 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:39:40.693240 0.000000 tcp 10.0.2.16 49514 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 17:39:47.412902 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:52.691022 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:39:57.698185 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:02.705100 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:03.701061 0.177429 tcp 10.0.2.16 49515 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:03.878769 0.210981 tcp 10.0.2.16 49516 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:04.090707 0.101782 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:40:04.193015 0.176381 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 17:40:04.369947 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:21.782887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 17:40:38.578642 0.180323 tcp 10.0.2.16 49517 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:40:38.759516 0.207006 tcp 10.0.2.16 49518 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:41:48.080462 3.000198 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:41:55.086572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:03.088438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:19.091400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:51.097010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:48:55.104807 3.000075 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:49:02.110558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:10.112132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:26.115685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:58.120961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:02.129111 2.999332 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:56:09.134909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:17.135702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:33.138735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:57:05.144812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:09.152470 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:03:16.158263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:24.159795 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:40.163366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:04:12.168746 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:16.176283 3.000051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:10:23.182627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:31.184233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:44.633552 0.000164 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:10:44.633867 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:10:47.186587 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:00.947073 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:17.655893 0.177866 tcp 10.0.2.16 49519 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:11:17.833446 0.211915 tcp 10.0.2.16 49520 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:11:18.046324 4.725756 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1898 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.158698 3.738150 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.159864 3.006220 tcp 10.0.2.16 49521 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:11:18.256024 4.179363 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:18.431286 0.172318 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:19.193496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:22.771040 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:27.164400 0.000000 tcp 10.0.2.16 49521 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:11:30.379049 0.174115 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 569 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:11:39.161981 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:44.169344 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:11:49.175893 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:17:23.199998 3.000868 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:17:30.206053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:38.207899 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:54.211224 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:18:26.217285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:30.224496 2.999918 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:24:37.230023 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:45.232292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:25:01.234570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:25:33.241146 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:37.248564 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:31:44.254174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:52.255549 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:32:08.259090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:32:40.264929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:44.272537 3.000137 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:38:51.278569 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:59.280090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:39:15.283007 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:39:47.289076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:41:52.288906 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:41:52.289249 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:07.571110 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:25.360566 1.780677 tcp 10.0.2.16 49522 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:42:25.542503 0.209090 tcp 10.0.2.16 49523 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:42:25.752587 0.175927 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:25.929119 0.097985 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:25.929656 2.991906 tcp 10.0.2.16 49524 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:42:26.027633 0.112189 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 579 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 18:42:26.138960 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:34.919922 0.000000 tcp 10.0.2.16 49524 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 18:42:43.733252 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:46.927340 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:51.934623 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:42:56.941760 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 18:43:02.071211 1.888463 tcp 10.0.2.16 49525 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:43:02.249347 0.208161 tcp 10.0.2.16 49526 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:45:51.296412 3.000107 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 18:45:58.301925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:06.303829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:22.306871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:54.312487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:52:58.320405 2.999692 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:53:05.325925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:13.327806 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:29.330607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:54:01.336741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:05.343960 3.000810 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:00:12.349976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:20.352087 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:36.354350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:01:08.360626 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:12.368215 2.999896 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:07:19.374571 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:27.375548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:43.378595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:08:15.384367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:13:26.572638 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:13:26.572991 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:13:45.379665 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:01.564800 0.177871 tcp 10.0.2.16 49527 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:14:01.742884 0.213199 tcp 10.0.2.16 49528 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:14:01.956634 4.711713 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1460 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.058252 3.978513 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.058577 2.998694 tcp 10.0.2.16 49529 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:14:02.232142 4.138149 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1949 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:02.344891 0.174774 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:06.668743 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:11.055975 0.000000 tcp 10.0.2.16 49529 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:14:14.600897 0.429851 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 534 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:14:19.390216 3.002390 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 19:14:23.053717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 137 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:26.398424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:28.060901 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:33.067615 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:14:34.399819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:50.402496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:15:22.408757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:26.415963 3.000298 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:21:33.422383 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:41.423360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:57.426919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:22:29.432582 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:33.439669 3.001089 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:28:40.446150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:48.448165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:29:04.450403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:29:36.456264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:40.464243 2.999928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:35:47.469907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:55.471969 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:11.474160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:43.480480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:42:47.488269 2.999895 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:42:54.493903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:02.495898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:18.498272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:50.504215 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:44:19.205923 0.000193 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:44:19.206294 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:44:34.367529 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:44:53.289551 0.178263 tcp 10.0.2.16 49530 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:44:53.468339 0.215774 tcp 10.0.2.16 49531 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:44:53.685050 0.111520 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 433 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:53.795927 0.101606 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 255 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:53.796909 2.993195 tcp 10.0.2.16 49532 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:44:53.898056 0.173335 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 324 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 19:44:54.071903 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:02.798053 0.000000 tcp 10.0.2.16 49532 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 19:45:12.432295 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:14.806146 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:19.813179 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:24.820593 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 19:45:30.500482 0.178305 tcp 10.0.2.16 49533 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:45:30.679290 0.207049 tcp 10.0.2.16 49534 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:49:54.511722 3.000588 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 19:50:01.517914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:09.519511 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:25.522219 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:57.528849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:01.535601 3.000779 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:57:08.541706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:16.543955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:32.546800 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:58:04.552802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:08.560114 3.000045 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:04:15.565893 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:23.567708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:39.570034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:05:11.576619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:15.584307 2.999967 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:11:22.590004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:30.591660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:46.594045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:12:18.600689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:15:43.315100 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:15:43.315418 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:15:59.938641 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:15.165147 1.959027 tcp 10.0.2.16 49535 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:16:15.343068 0.217244 tcp 10.0.2.16 49536 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:16:15.561453 3.856247 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1380 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.659930 4.617043 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1982 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.660468 3.005368 tcp 10.0.2.16 49537 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:16:15.771023 4.171762 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:15.947497 0.175645 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:20.276065 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:24.664640 0.000000 tcp 10.0.2.16 49537 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:16:29.151133 0.174197 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 578 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:16:36.661638 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:41.668588 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:16:46.675740 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:18:22.607505 3.000753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 20:18:29.613923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:37.615034 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:53.618473 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:19:25.624918 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:29.631853 3.000072 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:25:36.637541 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:44.639426 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:26:00.642036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:26:32.648551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:36.655636 3.000490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:32:43.661751 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:51.663058 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:33:07.666092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:33:39.671959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:43.679633 3.000392 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:39:50.685359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:58.687827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:40:14.689870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:40:46.695975 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:46:42.628337 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:46:42.628638 0.097982 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 238 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:46:42.727364 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:46:42.728104 3.003983 tcp 10.0.2.16 49538 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:46:50.703893 3.000024 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:46:51.730960 0.000000 tcp 10.0.2.16 49538 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 20:46:57.709988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:46:58.731679 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:03.738406 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:05.711413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:08.745385 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:13.752961 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:17.061825 0.176676 tcp 10.0.2.16 49539 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:17.238981 0.208842 tcp 10.0.2.16 49540 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:17.448937 0.111971 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 470 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:47:17.560395 0.175661 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 20:47:17.736604 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:21.714223 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:34.082122 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 20:47:50.868543 0.178383 tcp 10.0.2.16 49541 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:51.047168 0.209793 tcp 10.0.2.16 49542 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:47:53.719888 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:53:57.728123 3.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:54:04.733656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:12.735671 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:28.738450 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:55:00.747720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:04.751709 3.000367 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:01:11.757372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:19.759385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:35.761794 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:02:07.768395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:11.775714 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:08:18.781240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:26.782934 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:42.786258 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:09:14.792467 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:18.799258 3.000769 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:15:25.805790 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:33.806725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:49.809738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:16:21.816013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:18:07.658986 0.000348 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:18:07.659454 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:26.064773 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:42.723486 0.178050 tcp 10.0.2.16 49543 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:18:42.901813 0.210783 tcp 10.0.2.16 49544 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:18:43.113574 4.724870 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1767 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.212602 3.798305 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.213149 3.000608 tcp 10.0.2.16 49545 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:18:43.324907 4.219847 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1437 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:43.504562 0.173100 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 662 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:18:47.838977 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:18:52.212342 0.000000 tcp 10.0.2.16 49545 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:18:53.223752 0.179020 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:19:04.209717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:19:09.217053 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:19:14.224140 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:22:25.823454 3.000495 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:22:32.829200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:40.831098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:56.834300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:23:28.840072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:32.847085 3.001041 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:29:39.853544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:47.855013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:30:03.857907 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:30:35.864036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:39.871925 3.000009 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:36:46.877503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:54.878577 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:37:10.881742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:37:42.887773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:43:46.895143 3.000706 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:43:53.901046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:01.903118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:17.906727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:49.912828 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:49:03.346334 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:49:03.346659 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:20.121006 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:39.011739 0.177276 tcp 10.0.2.16 49546 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:49:39.189457 0.213765 tcp 10.0.2.16 49547 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:49:39.404243 0.176759 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.581634 0.112160 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 652 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.582252 3.000729 tcp 10.0.2.16 49548 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:49:39.693469 0.097243 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 21:49:39.791349 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:49:48.581742 0.000000 tcp 10.0.2.16 49548 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 21:49:58.015154 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:00.578904 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:05.586342 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:10.593548 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 21:50:15.311496 0.183271 tcp 10.0.2.16 49549 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:50:15.495309 0.224770 tcp 10.0.2.16 49550 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:50:53.918490 3.001142 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:51:00.925168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:08.927011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:24.930027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:56.936323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:00.943681 2.999956 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:58:07.949345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:15.950445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:31.953506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:59:03.959986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:07.967525 2.999762 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:05:14.973413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:22.975082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:38.977801 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:06:10.983882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:14.991687 3.000019 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:12:21.997550 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:29.998822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:46.001573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:13:18.007513 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:22.013517 3.002161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:19:29.021029 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:37.022546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:53.025612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:20:25.031948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:20:26.003456 0.000096 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:20:26.003646 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:20:43.759025 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:02.097919 0.177403 tcp 10.0.2.16 49551 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:21:02.275040 0.216231 tcp 10.0.2.16 49552 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:21:02.491841 4.088529 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1374 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.669711 4.534019 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2194 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.670026 3.000373 tcp 10.0.2.16 49553 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:21:02.780065 4.089177 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1624 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:02.878154 0.176878 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 383 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:07.202603 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:11.668524 0.000000 tcp 10.0.2.16 49553 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:21:13.160722 0.171480 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:21:23.676213 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:28.683782 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:21:33.690473 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:26:29.039341 3.000024 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:26:36.044849 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:26:44.046859 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:00.049598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:32.055534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:36.063385 3.000061 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:33:43.068792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:51.070776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:34:07.073770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:34:39.079443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:43.087270 2.999828 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:40:50.093002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:58.094712 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:41:14.097315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:41:46.104188 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:47:50.111671 3.000028 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:47:57.117092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:05.118814 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:21.121505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:53.128055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:51:33.118076 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:51:33.119267 0.178650 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 301 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:51:33.298651 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:33.299398 3.002477 tcp 10.0.2.16 49554 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:51:42.300955 0.000000 tcp 10.0.2.16 49554 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 22:51:49.531398 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:54.308053 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:51:59.315535 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:04.323003 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:05.639291 0.176396 tcp 10.0.2.16 49555 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:05.816105 0.206297 tcp 10.0.2.16 49556 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:06.023419 0.112187 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:52:06.134605 0.098058 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 22:52:06.233198 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:23.250474 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 22:52:40.236306 0.177486 tcp 10.0.2.16 49557 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:52:40.414007 0.224088 tcp 10.0.2.16 49558 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:54:57.134909 3.000491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:55:04.141178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:12.142298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:28.145889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:56:00.151543 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:04.159403 3.000203 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:02:11.164825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:19.166389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:35.169250 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:03:07.175362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:11.184123 2.999182 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:09:18.188897 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:26.190455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:42.193327 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:10:14.199074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:18.207573 2.999453 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:16:25.213045 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:33.214464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:49.217324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:17:21.223237 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:22:46.301186 0.000102 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:22:46.301398 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:05.137801 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:23.338906 0.176815 tcp 10.0.2.16 49559 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:23:23.516019 0.209816 tcp 10.0.2.16 49560 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:23:23.726811 4.729431 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:23.900006 3.723617 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2050 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:23.900557 2.988270 tcp 10.0.2.16 49561 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:23:24.012404 3.910653 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1567 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:24.113997 0.176053 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 726 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:25.230851 3.000304 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 23:23:28.456833 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:32.236847 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:32.897533 0.000000 tcp 10.0.2.16 49561 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:23:33.910255 0.177482 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 502 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:23:40.238706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:44.906154 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:49.914028 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:54.919515 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:23:56.241169 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:24:28.247760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:32.254832 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:30:39.260535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:47.262160 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:31:03.265529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:31:35.271477 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:39.278833 3.000186 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:37:46.285262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:54.286528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:38:10.289428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:38:42.295154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:44:46.301318 3.002044 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:44:53.308692 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:01.309861 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:17.313705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:49.319103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:51:53.327277 2.999493 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:52:00.332768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:08.334377 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:24.337089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:56.343874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:53:44.012513 0.000084 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:53:44.012719 0.113336 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:53:44.125732 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:53:44.126772 2.999140 tcp 10.0.2.16 49562 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:53:53.125091 0.000000 tcp 10.0.2.16 49562 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/02 23:54:01.857400 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:05.122218 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:10.129269 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:15.136899 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:19.397650 0.178932 tcp 10.0.2.16 49563 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:19.576985 0.209842 tcp 10.0.2.16 49564 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:19.787839 0.172580 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:54:19.961019 0.097826 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 259 flow=From-Botnet-V1-UDP-Establishedd 1970/01/02 23:54:20.059471 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:36.547564 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/02 23:54:51.631425 0.179661 tcp 10.0.2.16 49565 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:54:51.811425 0.213607 tcp 10.0.2.16 49566 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:59:00.350856 3.000222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 23:59:07.357019 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:15.358028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:31.361514 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:00:03.367528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:07.375520 2.999379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:06:14.381230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:22.382110 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:38.384872 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:07:10.391209 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:14.396755 3.001897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:13:21.405055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:29.405883 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:45.409082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:14:17.415062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:21.422363 3.000449 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:20:28.428853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:36.430221 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:52.433187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:21:24.439198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:25:02.252157 0.000135 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:25:02.252411 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:19.267461 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:34.513306 0.179331 tcp 10.0.2.16 49567 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:25:34.693122 0.211653 tcp 10.0.2.16 49568 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:25:34.905729 4.723842 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2070 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.018844 3.983559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.019984 3.003830 tcp 10.0.2.16 49569 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:25:35.195452 4.097641 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1457 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:35.292123 0.178713 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 680 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:39.628809 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:25:44.022062 0.000000 tcp 10.0.2.16 49569 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:25:44.823697 0.174677 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 568 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:25:56.020415 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:26:01.026729 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:26:06.034245 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:27:28.447191 2.999362 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 00:27:35.452299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:43.454149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:59.457193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:28:31.463148 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:35.470974 2.999844 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:34:42.476424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:50.477796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:35:06.481035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:35:38.486733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:42.495096 2.999324 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:41:49.500774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:57.502194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:42:13.504903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:42:45.511212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:48:49.519077 2.999654 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:48:56.524192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:04.525618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:20.528951 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:52.534723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:55:56.542725 3.000277 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:56:03.548449 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:06.552548 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:56:06.552809 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:11.550395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:22.535674 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:27.553128 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:40.244172 0.178396 tcp 10.0.2.16 49570 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:56:40.422925 0.209464 tcp 10.0.2.16 49571 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:56:40.633415 0.098686 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 251 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:40.732824 0.111454 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 504 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:40.733410 3.002660 tcp 10.0.2.16 49572 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:56:40.843964 0.176673 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 345 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 00:56:41.021281 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:49.734769 0.000000 tcp 10.0.2.16 49572 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 00:56:56.594912 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:56:59.558912 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:57:01.732611 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:06.739189 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:11.746958 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 00:57:12.810268 0.177101 tcp 10.0.2.16 49573 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:57:12.987581 0.245436 tcp 10.0.2.16 49574 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:03:03.566875 3.000064 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:03:10.572817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:18.573935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:34.576892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:04:06.582606 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:10.590585 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:10:17.596322 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:25.597791 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:41.601072 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:11:13.606540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:17.614084 3.000434 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:17:24.620355 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:32.622252 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:48.624628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:18:20.631028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:24.636917 3.002033 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:24:31.644099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:39.645551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:55.649065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:25:27.654946 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:27:15.299891 0.000125 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:27:15.300250 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:34.127092 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:49.441381 0.179346 tcp 10.0.2.16 49575 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:27:49.621189 0.216783 tcp 10.0.2.16 49576 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:27:49.839196 4.741195 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2105 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:49.950315 3.744356 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:49.950939 3.002808 tcp 10.0.2.16 49577 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:27:50.048773 4.181482 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1699 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:50.228815 0.173719 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 548 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:27:54.598323 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:27:58.952164 0.000000 tcp 10.0.2.16 49577 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:28:01.856912 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:07.274803 0.175734 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 618 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:28:10.949990 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:15.956896 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:28:20.964001 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:31:31.662264 3.000217 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 01:31:38.668470 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:31:46.669636 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:32:02.672843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:32:34.678532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:38.686094 3.000347 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:38:45.692284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:53.693574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:39:09.696420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:39:41.703069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:45:45.710133 3.000673 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:45:52.716571 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:00.717648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:16.720603 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:48.726959 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:52:52.732377 3.002470 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:52:59.740197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:07.741352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:23.744936 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:55.751060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:58:36.594571 0.000203 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:58:36.594947 0.097516 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:58:36.692908 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:58:36.693333 2.995496 tcp 10.0.2.16 49578 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:58:45.697198 0.000000 tcp 10.0.2.16 49578 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 01:58:52.037101 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:58:57.695370 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:02.701946 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:07.709372 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:09.356053 0.179512 tcp 10.0.2.16 49579 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:09.536036 0.206215 tcp 10.0.2.16 49580 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:09.743432 0.126361 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 454 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:59:09.857185 0.175409 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 01:59:10.033218 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:25.585152 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 01:59:43.793270 0.178799 tcp 10.0.2.16 49581 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:43.972543 0.213903 tcp 10.0.2.16 49582 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:59:59.758115 3.000529 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:00:06.764284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:14.765743 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:30.768833 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:01:02.774576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:06.782549 2.999801 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:07:13.787741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:21.789745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:37.792715 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:08:09.798446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:13.806033 3.000630 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:14:20.811825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:28.813812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:44.816702 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:15:16.822654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:20.830207 3.000148 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:21:27.836088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:35.837493 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:51.840390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:22:23.846882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:27.854383 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:28:34.859889 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:42.861869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:58.864441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:29:30.871077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:29:58.891327 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:29:58.891619 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:15.735783 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:31.662924 0.175911 tcp 10.0.2.16 49583 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:30:31.839408 0.208620 tcp 10.0.2.16 49584 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:30:32.049071 4.808437 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1410 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.147686 3.889643 rtp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2037 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.148250 2.994747 tcp 10.0.2.16 49585 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 02:30:32.288649 4.275162 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:32.466248 0.174387 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:36.858025 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:41.141818 0.000000 tcp 10.0.2.16 49585 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 02:30:41.963312 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 308 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:49.273510 0.179917 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 473 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:52.447798 0.527367 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1106 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:30:52.975786 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:53.139676 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:30:58.146494 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:01.140705 0.178245 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 475 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:03.153413 1.827840 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1455 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:04.314763 0.375333 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1529 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 02:31:04.981644 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:10.664230 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:15.591454 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:31:16.893545 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:24.113881 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:29.902627 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:36.841534 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:45.493958 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:52.424167 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:31:57.090857 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:31:58.994002 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:05.753726 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:12.593273 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:32:18.712419 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 02:35:34.878215 3.000099 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:35:41.884214 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:35:49.885721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:36:05.888821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:36:37.894376 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:41.902375 3.000582 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:42:48.908864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:56.910546 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:43:12.912041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:43:44.918689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:49:48.925828 3.000205 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:49:55.931494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:03.933626 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:19.936366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:51.942316 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:56:55.949561 3.000911 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:57:02.955879 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:10.957291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:26.960185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:58.966580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:02:27.723734 0.000175 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:02:27.724084 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:02:46.319887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:03.649030 0.382808 tcp 10.0.2.16 49586 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:04.032383 0.202925 tcp 10.0.2.16 49587 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:04.236264 0.270861 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:03:04.507858 0.122805 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:03:04.508390 3.001650 tcp 10.0.2.16 49588 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:03:04.630181 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:13.508816 0.000000 tcp 10.0.2.16 49588 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:03:21.810669 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:25.516557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:30.523441 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:35.530352 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:03:38.606798 0.179037 tcp 10.0.2.16 49589 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:38.785670 0.210858 tcp 10.0.2.16 49590 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:03:38.997498 0.103603 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:04:02.974163 2.999586 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:04:09.979932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:17.981306 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:33.984230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:05:05.990566 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:09.998242 2.999788 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:11:17.003896 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:25.005236 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:41.008013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:12:13.013992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:17.020525 3.001347 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:18:24.027664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:32.028938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:48.032366 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:19:20.038198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:24.046018 3.000096 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:25:31.051544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:39.052905 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:55.056231 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:26:27.061938 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:31.069622 3.000367 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:32:38.075444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:46.077159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:02.080647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:34.086592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:39.364308 0.000151 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:33:39.364623 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:33:57.941041 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:14.999391 0.177762 tcp 10.0.2.16 49591 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:15.177398 0.210966 tcp 10.0.2.16 49592 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:15.388933 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:30.547584 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:45.741294 0.178228 tcp 10.0.2.16 49593 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:45.919944 0.210777 tcp 10.0.2.16 49594 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:34:46.131838 0.268840 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.401440 0.136828 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 649 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.402034 3.002728 tcp 10.0.2.16 49595 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:34:46.537698 0.096885 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 271 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:46.635057 0.273920 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 408 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:49.906553 0.276177 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 634 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.179920 0.407725 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.587141 0.290461 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1235 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:53.878075 0.807053 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1191 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:34:54.685763 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:34:55.403075 0.000000 tcp 10.0.2.16 49595 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 03:35:03.434847 0.280819 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 03:35:07.400654 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:35:12.408483 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:35:17.415765 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 03:39:38.093460 3.000413 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:39:45.099932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:39:53.101641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:09.104189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:41.110837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:46:45.117840 3.000483 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:46:52.123855 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:00.124980 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:16.128275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:48.134100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:53:52.141588 3.000994 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:53:59.147731 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:07.149272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:23.152471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:55.158581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:00:59.165581 3.000277 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:01:06.171565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:14.172902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:30.175880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:02:02.182478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:05:23.761926 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:05:23.762270 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:05:39.985514 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:05:57.796067 0.375868 tcp 10.0.2.16 49596 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:05:58.172439 0.242155 tcp 10.0.2.16 49597 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:05:58.415170 0.141165 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 770 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:05:58.555622 0.098458 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 341 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:05:58.555955 2.999911 tcp 10.0.2.16 49598 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:05:58.654522 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:07.554667 0.000000 tcp 10.0.2.16 49598 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:16.587878 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:19.553006 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 93 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:24.559626 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:29.566919 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:35.286771 0.177198 tcp 10.0.2.16 49599 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:06:35.464334 0.211712 tcp 10.0.2.16 49600 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:06:35.677003 0.269368 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:06:35.947019 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:35.947658 2.992169 tcp 10.0.2.16 49601 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:44.938685 0.000000 tcp 10.0.2.16 49601 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:06:51.578123 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:06:56.946675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:01.953336 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:06.960013 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:07:08.855804 1.893043 tcp 10.0.2.16 49602 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:07:09.033339 0.213398 tcp 10.0.2.16 49603 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:08:06.189435 3.000672 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:08:13.195782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:21.196972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:37.200008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:09:09.206114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:13.213656 2.999731 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:15:20.219494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:28.220713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:44.224480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:16:16.230272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:20.237592 3.000316 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:22:27.243598 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:35.244596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:51.248084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:23:23.253711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:27.259397 3.002183 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:29:34.267325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:42.269064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:58.272078 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:30:30.278118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:34.285712 3.000190 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:36:41.291510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:49.292609 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:05.295670 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:20.668654 0.000097 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:37:20.668859 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:37:37.302234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:38.193488 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:37:54.401143 0.191203 tcp 10.0.2.16 49604 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:37:54.591895 0.209566 tcp 10.0.2.16 49605 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:37:54.802460 4.917138 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 920 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:54.956386 3.939734 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:54.957608 2.994115 tcp 10.0.2.16 49606 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:37:55.054460 4.664523 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1496 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:55.328687 0.277635 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 656 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:37:59.875921 0.313076 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1506 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:00.188032 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:03.950235 0.000000 tcp 10.0.2.16 49606 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:05.903957 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:14.885886 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:15.957344 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:20.964876 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:22.747653 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:25.971989 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:29.445974 0.270451 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:32.711690 0.814801 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1174 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:33.527013 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:33.527381 2.999714 tcp 10.0.2.16 49607 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:37.588285 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:38:38.971118 0.272966 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 572 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.245822 0.439800 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1810 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.525309 0.000000 tcp 10.0.2.16 49607 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 04:38:42.685070 0.292357 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1200 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 04:38:42.977984 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:50.337242 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:54.523317 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:59.270295 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:38:59.529927 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:04.277316 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:04.537683 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:13.220075 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:21.692313 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:26.588851 0.000209 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:39:27.520705 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 295 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:33.348699 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:41.651353 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:49.211977 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:39:54.600036 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:40:02.140185 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 04:43:41.309264 3.000782 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:43:48.315523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:43:56.317053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:44:12.320185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:44:44.326166 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:50:48.333559 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:50:55.339482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:03.340933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:19.343643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:51.349767 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:57:55.355800 3.001766 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:58:02.363668 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:10.365047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:26.368194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:58.374321 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:02.380961 3.000687 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:05:09.387635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:17.388442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:33.391438 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:06:05.398108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:10:27.284542 0.000086 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:10:27.284720 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:10:44.619917 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:01.108558 0.203130 tcp 10.0.2.16 49608 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:01.312146 0.212460 tcp 10.0.2.16 49609 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:01.525612 0.272593 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:01.798812 0.148874 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 533 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:01.799409 2.998564 tcp 10.0.2.16 49610 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:01.947332 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:10.807104 0.000000 tcp 10.0.2.16 49610 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:20.450619 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:22.804278 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:27.811625 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:32.818986 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:11:37.647557 0.178194 tcp 10.0.2.16 49611 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:37.825978 0.232853 tcp 10.0.2.16 49612 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:11:38.059830 0.101095 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 335 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:11:38.161816 2.998856 tcp 10.0.2.16 49613 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:47.159177 0.000000 tcp 10.0.2.16 49613 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:11:59.166868 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:04.173529 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:09.181380 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:12:09.405269 2.999815 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:12:16.410821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:24.412834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:40.415367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:13:12.421424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:16.429055 2.999977 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:19:23.434850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:31.436347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:47.439724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:20:19.446041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:23.453467 3.000265 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:26:30.459192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:38.460921 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:54.463430 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:27:26.469695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:30.477560 3.000333 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:33:37.483481 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:45.484858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:34:01.487818 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:34:33.493576 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:37.501224 3.000019 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:40:44.506725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:52.508878 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:08.511981 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:38.305114 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:41:38.305440 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:41:40.517489 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:53.936901 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:10.686158 0.201702 tcp 10.0.2.16 49614 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:10.888384 0.215252 tcp 10.0.2.16 49615 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:11.104594 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:26.994421 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:45.882631 0.178054 tcp 10.0.2.16 49616 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:46.060877 0.209397 tcp 10.0.2.16 49617 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:46.271314 0.271262 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.543182 0.136583 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 538 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.543852 3.002728 tcp 10.0.2.16 49618 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:42:46.679288 0.097493 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 331 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:46.777461 0.271611 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 658 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:50.047659 0.270518 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 550 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:53.322746 0.425062 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1503 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:53.746956 0.290849 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:54.038333 0.811088 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:42:54.850026 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:42:55.545297 0.000000 tcp 10.0.2.16 49618 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 05:43:01.784760 0.270751 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 05:43:07.543223 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:43:12.550477 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:43:17.557485 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 05:47:44.525062 3.000547 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:47:51.531044 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:47:59.532556 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:48:15.535409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:48:47.541263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:54:51.548763 3.000379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:54:58.554873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:06.556969 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:22.559360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:54.565590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:01:58.573400 2.999522 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:02:05.579270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:13.580776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:29.583694 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:03:01.589625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:05.597479 2.999416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:09:12.602629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:20.604203 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:36.607787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:10:08.613516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:13:28.221127 0.000198 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:13:28.221543 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:13:45.665687 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:03.676268 0.202257 tcp 10.0.2.16 49619 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:03.879045 0.211162 tcp 10.0.2.16 49620 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:04.091271 0.144455 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 541 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:04.234411 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:04.235013 3.001247 tcp 10.0.2.16 49621 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:14:13.235329 0.000000 tcp 10.0.2.16 49621 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:14:20.536247 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:25.232829 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:30.239598 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:35.246951 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:36.710920 0.205906 tcp 10.0.2.16 49622 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:36.917281 0.210707 tcp 10.0.2.16 49623 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:14:37.128959 0.273066 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:37.402544 0.100450 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:14:37.503710 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:14:52.992423 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:15:11.461573 0.201741 tcp 10.0.2.16 49624 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:15:11.662890 0.214462 tcp 10.0.2.16 49625 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:16:12.621282 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 06:16:19.627196 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:27.628374 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:43.631309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:17:15.637756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:19.645113 2.999649 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:23:26.650647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:34.652229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:50.655132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:24:22.661439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:26.668906 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:30:33.674588 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:41.676388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:57.679742 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:31:29.685662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:33.693137 2.999522 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:37:40.698957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:48.700616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:38:04.703251 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:38:36.709381 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:40.717027 2.999984 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:44:47.722435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:55.724396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:11.727385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:11.987744 0.000160 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:45:11.988088 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:28.992328 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:43.733038 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:45.330878 0.183809 tcp 10.0.2.16 49626 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:45:45.514921 0.210181 tcp 10.0.2.16 49627 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:45:45.726197 4.145171 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:45.854112 4.874568 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1367 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:45.855014 2.996000 tcp 10.0.2.16 49628 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:45:46.126420 4.055008 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:46.231817 0.275849 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:45:50.999258 0.000000 udp 10.0.2.16 15311 <- 66.148.64.18 24305 RSP 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:50.999818 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:45:54.849139 0.000000 tcp 10.0.2.16 49628 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 06:45:59.185760 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:06.338505 0.271029 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 711 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:06.856870 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:09.611038 0.825688 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1384 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:10.437326 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:11.864130 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:16.871374 4.438724 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1845 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:17.692577 0.279356 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 713 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:21.309360 0.295578 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1483 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 06:46:21.605548 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:29.489505 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:34.085704 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:46:38.372113 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:46.653737 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:46:55.476917 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:02.967642 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:11.499650 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:16.085761 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:47:17.007485 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:22.796294 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:28.243921 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:35.104243 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:47:42.985524 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 06:51:47.740693 3.000012 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 06:51:54.746379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:02.748070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:18.751402 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:50.757308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:58:54.765136 2.999697 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:59:01.770691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:09.772112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:25.774832 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:57.781074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:01.789083 2.999511 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:06:08.794583 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:16.796234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:32.799011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:07:04.805429 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:08.811091 3.001549 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:13:15.818460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:23.820080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:39.822949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:14:11.829114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:17:54.469265 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:17:54.470347 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:11.774668 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:27.751788 0.269334 tcp 10.0.2.16 49629 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:18:28.021456 0.234787 tcp 10.0.2.16 49630 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:18:28.257251 0.297415 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 234 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.555444 0.115024 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 708 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.556029 2.996513 tcp 10.0.2.16 49631 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:18:28.669878 0.101608 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 248 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:18:28.772084 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:37.551650 0.000000 tcp 10.0.2.16 49631 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:18:44.230915 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:49.548931 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:54.556326 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:18:59.563144 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:19:02.359132 0.176921 tcp 10.0.2.16 49632 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:19:02.536396 0.205978 tcp 10.0.2.16 49633 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:20:15.835245 3.001804 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 07:20:22.842709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:30.844570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:46.847379 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:21:18.853313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:22.860880 2.999713 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:27:29.866879 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:37.867784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:53.871487 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:28:25.877289 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:29.884344 3.000274 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:34:36.890286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:44.891898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:35:00.894684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:35:32.901885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:36.909848 2.999118 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:41:43.914505 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:51.915836 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:42:07.919375 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:42:39.924718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:43.932826 2.999818 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:48:50.938621 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:58.939696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:14.943482 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:30.054937 0.000147 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:49:30.055239 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:49:46.949310 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:48.982117 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:07.713489 0.203961 tcp 10.0.2.16 49634 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:07.917826 0.209059 tcp 10.0.2.16 49635 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:08.128089 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:26.826727 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:45.815248 0.202118 tcp 10.0.2.16 49636 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:46.017626 0.209334 tcp 10.0.2.16 49637 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:50:46.228125 0.112000 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.339115 0.272559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 365 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.339794 2.998796 tcp 10.0.2.16 49638 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:50:46.612226 0.100454 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 227 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:46.713341 0.271805 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 648 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:49.989505 0.274615 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 654 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:53.264654 0.814631 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1117 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.079901 0.301820 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1369 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.382260 0.339033 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1583 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:50:54.720529 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:50:55.347390 0.000000 tcp 10.0.2.16 49638 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:03.329058 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:07.344789 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:11.411107 0.272007 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 616 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:12.352116 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:14.685631 0.815034 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1204 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:15.501294 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:17.358913 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:22.276793 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:30.318238 0.333418 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1702 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:30.651411 0.294360 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:51:30.652221 2.999889 tcp 10.0.2.16 49639 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:30.946371 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:35.084278 0.000099 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:51:38.870466 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:39.650607 0.000000 tcp 10.0.2.16 49639 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 07:51:44.117380 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:51.648915 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:53.000745 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:51:56.655920 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:00.060207 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:01.662552 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:07.350869 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:12.598220 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:17.585417 0.000184 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:52:18.577253 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:25.717937 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:32.667688 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:40.649121 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:46.146798 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:52.535916 0.271970 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 07:52:55.810566 0.277937 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 07:52:56.088503 0.000000 icmp 66.36.228.41 0x0303 -> 10.0.2.16 0xb634 URP 192 1 322 flow=Background 1970/01/03 07:53:00.587084 0.000199 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:55:50.956512 3.000405 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 07:55:57.962055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:05.963570 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:21.966684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:53.972880 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:02:57.980457 3.000087 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:03:04.986386 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:12.988315 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:28.990512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:04:00.996631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:05.225169 3.000769 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:10:12.230740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:20.231809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:36.234933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:11:08.241097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:12.249093 2.999851 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:17:19.254290 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:27.256364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:43.259291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:18:15.264902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:23:22.397655 0.000124 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:23:22.397992 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:23:39.090786 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:23:54.247214 0.185918 tcp 10.0.2.16 49640 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:23:54.433558 0.211105 tcp 10.0.2.16 49641 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:23:54.645653 0.273559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:54.919638 0.113013 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 746 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:54.919964 3.007639 tcp 10.0.2.16 49642 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:23:55.032107 0.097382 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 226 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:23:55.130034 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:03.926673 0.000000 tcp 10.0.2.16 49642 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:24:12.448915 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:15.924156 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:19.272847 2.999873 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 08:24:20.930784 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:25.938446 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:24:26.278699 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:28.273868 1.891856 tcp 10.0.2.16 49643 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:24:28.452624 0.210943 tcp 10.0.2.16 49644 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:24:34.280200 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:50.283580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:25:22.289004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:26.296807 3.000069 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:31:33.302483 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:41.303991 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:57.306972 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:32:29.313217 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:33.320396 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:38:40.326490 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:48.328596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:39:04.331341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:39:36.336723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:40.344466 3.000577 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:45:47.350184 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:55.352302 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:46:11.355754 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:46:43.361349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:52:47.368697 2.999915 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:52:54.374154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:02.375623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:18.378602 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:50.384947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:54:51.273083 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:54:51.273409 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:09.939883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:28.680776 0.178080 tcp 10.0.2.16 49645 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:55:28.859181 0.211408 tcp 10.0.2.16 49646 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:55:29.071575 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:55:45.260000 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:03.658560 0.178843 tcp 10.0.2.16 49647 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:56:03.837817 0.210125 tcp 10.0.2.16 49648 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:56:04.048932 0.275857 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 360 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.325434 0.113083 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 726 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.326008 2.996141 tcp 10.0.2.16 49649 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:04.438048 0.097606 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:04.536118 0.272532 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 441 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:07.812978 0.274422 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 703 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.087271 0.334055 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.420701 0.289803 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:11.711018 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:13.320071 0.000000 tcp 10.0.2.16 49649 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:17.486458 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:23.455442 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:25.327948 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:30.335300 4.989960 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:31.227684 0.271163 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:35.325944 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:35.342174 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:41.821179 0.274143 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.096694 0.334284 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1584 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.431313 0.304182 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1037 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 08:56:45.431885 2.999163 tcp 10.0.2.16 49650 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:45.736088 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:46.708199 0.000123 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:56:51.736168 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:56:54.429247 0.000000 tcp 10.0.2.16 49650 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 08:56:59.967631 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:06.436971 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:08.529726 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:11.444116 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:14.429500 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:16.451759 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:19.806172 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:26.686418 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:31.212064 0.000133 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:57:35.519007 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:43.540679 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:52.332723 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:57:58.040994 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:58:05.051580 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 08:59:54.392388 3.000203 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 09:00:01.398225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:09.400341 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:25.403292 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:57.408929 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:01.414803 3.001687 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:07:08.421953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:16.423993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:32.427094 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:08:04.432842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:08.440660 2.999888 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:14:15.446684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:23.447486 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:39.451198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:15:11.456696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:15.462147 3.002327 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:21:22.470262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:30.472150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:46.474734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:22:18.481013 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:22.486909 3.001222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:28:29.493979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:37.495661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:40.720634 0.000078 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:28:40.720798 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:28:53.498715 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:59.327407 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:16.774944 0.177305 tcp 10.0.2.16 49651 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:16.952012 0.214664 tcp 10.0.2.16 49652 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:17.167240 0.276299 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 285 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.443964 0.113074 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 627 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.444299 3.002939 tcp 10.0.2.16 49653 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 09:29:17.556444 0.101547 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 09:29:17.658421 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:25.504874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:29:26.446334 0.000000 tcp 10.0.2.16 49653 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 09:29:33.325861 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:38.443491 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:43.450447 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:48.457985 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 09:29:51.223443 0.181656 tcp 10.0.2.16 49654 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:29:51.405251 0.206365 tcp 10.0.2.16 49655 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:35:29.512591 2.999836 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:35:36.517933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:35:44.519859 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:00.522690 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:32.528771 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:36.536994 2.999699 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:42:43.542076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:51.543819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:07.546523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:39.552721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:49:43.558461 3.002158 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:49:50.566267 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:49:58.567691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:14.571006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:46.576514 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:56:50.584176 3.000169 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:56:57.590191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:05.592133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:21.594452 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:53.601129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:00:08.724947 0.000157 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:00:08.725249 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 107 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:00:27.311640 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:00:44.188711 0.177916 tcp 10.0.2.16 49656 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:00:44.367125 0.210464 tcp 10.0.2.16 49657 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:00:44.578573 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:00.529321 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:15.643416 0.179303 tcp 10.0.2.16 49658 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:01:15.822884 0.208444 tcp 10.0.2.16 49659 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:01:16.032415 0.112827 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 639 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.144588 0.272068 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.145695 3.000184 tcp 10.0.2.16 49660 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:01:16.417232 0.097158 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 300 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:16.515109 0.276710 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 533 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:19.787422 0.279086 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 607 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:23.062331 0.818368 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1336 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:23.881236 0.290765 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:24.172493 0.332741 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1711 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:24.504202 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:25.144699 0.000000 tcp 10.0.2.16 49660 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:01:31.834789 0.277177 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 482 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:35.122271 0.818276 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1184 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:35.941097 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:37.142377 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:42.149708 4.268176 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1677 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:42.810683 0.278418 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 591 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:46.417317 0.290197 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:01:46.708144 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:47.156608 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:54.647384 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:01:59.203417 0.000132 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:02:01.547006 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:10.049366 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:17.029663 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:23.699005 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:30.209023 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:36.907897 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:41.705010 0.000091 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:02:43.808284 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:50.758090 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:02:55.935635 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:03:01.173271 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:03:57.608132 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 10:04:04.614064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:12.615610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:28.618939 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:05:00.624446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:04.632198 3.000073 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:11:11.637684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:19.639808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:35.642212 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:12:07.648565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:11.656595 2.999755 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:18:18.662339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:26.663782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:42.666279 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:19:14.672906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:18.679897 3.000700 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:25:25.685681 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:33.687517 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:49.690579 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:26:21.696691 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:25.704559 2.999606 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:32:32.710276 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:40.711202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:56.714309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:28.720555 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:37.202785 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:33:37.203069 0.273892 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 367 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:33:37.477645 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:33:37.478409 3.008930 tcp 10.0.2.16 49661 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:33:46.485870 0.000000 tcp 10.0.2.16 49661 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 10:33:53.836641 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:33:58.483783 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:03.490384 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 158 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:08.497666 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:09.383200 0.178484 tcp 10.0.2.16 49662 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:09.562127 0.215014 tcp 10.0.2.16 49663 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:09.778146 0.112687 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 777 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:34:09.890451 0.097140 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 10:34:09.988126 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:27.274653 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 10:34:44.570791 0.177742 tcp 10.0.2.16 49664 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:34:44.749022 0.205392 tcp 10.0.2.16 49665 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:39:32.728209 2.999598 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 10:39:39.733930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:39:47.735359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:03.738874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:35.744863 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:46:39.752791 2.999817 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:46:46.758363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:46:54.759659 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:10.762387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:42.768675 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:53:46.775788 3.000624 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:53:53.782000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:01.783144 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:17.786036 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:49.792903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:00:53.800033 3.000004 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:01:00.806240 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:08.807156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:24.810223 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:56.816006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:05:07.250777 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:05:07.251157 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:23.233383 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:41.143541 1.886624 tcp 10.0.2.16 49666 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:05:41.322926 0.204174 tcp 10.0.2.16 49667 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:05:41.528186 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:05:59.766139 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:16.181661 0.181142 tcp 10.0.2.16 49668 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:06:16.362642 0.210923 tcp 10.0.2.16 49669 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:06:16.574119 0.279918 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:16.854476 0.112598 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 765 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:16.854824 2.999711 tcp 10.0.2.16 49670 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:06:16.966344 0.098817 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 272 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:17.065599 0.272548 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:20.335600 0.276463 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 646 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:23.610102 0.837007 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1397 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:24.447848 0.295685 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1356 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:24.744078 0.333638 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1559 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:25.077189 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:25.853411 0.000000 tcp 10.0.2.16 49670 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:06:33.234369 0.272634 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:36.509303 1.341415 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:37.345682 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:42.857584 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:45.541368 0.275541 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:47.864626 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:48.816170 0.333090 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1507 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:49.148825 0.296185 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1281 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:06:49.445620 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:06:55.406247 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:00.202408 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:07:01.084086 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:07.403176 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:14.072690 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:19.871091 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:27.712334 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:34.992462 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:40.280135 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:45.207466 0.000115 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:07:48.522095 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:07:54.711462 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:08:00.823969 3.000174 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 11:08:02.612834 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:08:07.829686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:15.831408 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:31.834535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:09:03.840116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:07.847546 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:15:14.853733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:22.855703 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:38.858171 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:16:10.864593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:14.871643 3.000611 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:22:21.877707 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:29.879170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:45.881864 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:23:17.887996 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:21.895569 3.000508 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:29:28.901468 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:36.902973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:52.906222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:30:24.911876 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:28.917591 3.001928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:36:35.925349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:43.926976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:59.930286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:37:31.936507 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:38:35.628380 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:38:35.628706 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:38:50.970200 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:06.615033 0.176205 tcp 10.0.2.16 49671 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:06.791429 0.211011 tcp 10.0.2.16 49672 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:07.003029 0.271412 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 231 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:07.274899 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:07.275355 3.002122 tcp 10.0.2.16 49673 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:16.276679 0.000000 tcp 10.0.2.16 49673 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:25.509389 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:28.273940 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:33.281212 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:38.288334 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:39:44.228761 0.179004 tcp 10.0.2.16 49674 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:44.408222 0.208846 tcp 10.0.2.16 49675 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:44.618107 0.097748 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 368 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:44.716434 0.112135 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 11:39:44.717007 2.994535 tcp 10.0.2.16 49676 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:39:53.709609 0.000000 tcp 10.0.2.16 49676 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 11:40:05.717346 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:40:10.725028 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:40:15.731478 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 11:43:35.943697 3.000151 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 11:43:42.949603 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:43:50.951388 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:06.954456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:38.960173 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:50:42.967605 3.000572 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:50:49.973447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:50:57.975474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:13.978433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:45.983792 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:57:49.991298 3.000373 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:57:56.997291 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:04.998798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:21.002424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:53.008623 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:04:57.015105 3.000466 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:05:04.022222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:12.024162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:28.025872 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:06:00.032338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:09:52.245888 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:09:52.246223 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:07.638305 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:23.485734 0.178452 tcp 10.0.2.16 49677 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:23.664596 0.205538 tcp 10.0.2.16 49678 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:23.871107 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:41.326422 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:10:56.661066 0.177929 tcp 10.0.2.16 49679 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:56.839451 0.204388 tcp 10.0.2.16 49680 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:10:57.044861 0.272587 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.318131 0.112883 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 642 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.318731 3.005278 tcp 10.0.2.16 49681 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:10:57.430214 0.097621 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 266 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:10:57.528525 0.274938 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 529 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:00.804356 0.272977 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 549 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.079773 0.334754 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1470 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.413663 0.294935 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1100 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:04.709118 0.818696 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1144 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:05.528370 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:06.322309 0.000000 tcp 10.0.2.16 49681 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:11:12.481587 0.275440 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:15.755784 2.563930 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:16.583414 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:22.515730 0.271529 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 444 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:23.327369 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:25.790793 0.336109 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:26.125771 0.292986 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:11:26.419480 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:28.334675 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:34.273008 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:39.209489 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:11:39.490439 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:47.221807 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:11:52.999616 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:01.161353 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:04.038009 3.001461 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:12:09.453144 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:11.045433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:14.871416 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 141 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:19.046613 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:22.261426 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:27.209146 0.000159 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:12:29.281680 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:35.049733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:36.993266 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:12:45.335086 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 296 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:13:07.055734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:11.063488 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:19:18.069753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:26.071351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:42.074227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:20:14.080096 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:18.087980 2.999990 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:26:25.093565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:33.095028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:49.098005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:27:21.103964 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:25.112067 2.999501 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:33:32.117811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:40.118532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:56.122227 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:34:28.127923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:32.135505 2.999788 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:40:39.141051 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:47.142580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:03.145870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:35.151649 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:43:04.800576 0.000190 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:43:04.800937 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:21.885885 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:37.980845 0.180009 tcp 10.0.2.16 49682 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:43:38.160522 0.210499 tcp 10.0.2.16 49683 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:43:38.372116 0.269742 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 340 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:43:38.642488 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:38.643090 3.000935 tcp 10.0.2.16 49684 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:43:47.642639 0.000000 tcp 10.0.2.16 49684 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:43:56.225439 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:43:59.640015 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:04.646504 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:09.654379 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:14.773832 0.178095 tcp 10.0.2.16 49685 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:44:14.952276 0.205685 tcp 10.0.2.16 49686 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:44:15.158922 0.099507 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:44:15.258903 0.112381 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 671 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 12:44:15.259244 2.997354 tcp 10.0.2.16 49687 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:44:24.255101 0.000000 tcp 10.0.2.16 49687 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 12:44:36.252807 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:41.259541 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:44:46.266682 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 12:47:39.157730 3.001740 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:47:46.165458 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:47:54.167073 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:10.170085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:42.175909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:54:46.183468 2.999718 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:54:53.188998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:01.190840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:17.193716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:49.199868 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:01:53.207494 2.999922 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:02:00.213427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:08.215091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:24.217976 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:56.224068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:00.231607 3.000221 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:09:07.237180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:15.238730 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:31.241631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:10:03.248351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:14:20.738457 0.000180 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:14:20.738806 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:14:36.751368 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:14:54.210973 0.178740 tcp 10.0.2.16 49688 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:14:54.390077 0.212736 tcp 10.0.2.16 49689 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:14:54.604005 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:13.553862 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:28.607488 0.176584 tcp 10.0.2.16 49690 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:15:28.784639 0.205044 tcp 10.0.2.16 49691 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:15:28.990242 0.258050 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 395 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.248959 0.112670 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.249532 3.001107 tcp 10.0.2.16 49692 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:15:29.360779 0.098109 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 332 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:29.459695 0.258669 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:32.721647 0.265099 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 630 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:35.986245 0.334443 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1751 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:36.320331 0.293291 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1373 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:36.614175 0.802269 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1409 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:37.416981 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:38.249457 0.000000 tcp 10.0.2.16 49692 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:15:46.391436 0.266135 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 510 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:49.656226 0.805344 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1378 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:50.462179 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:55.264082 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:15:56.035616 0.266972 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.300086 0.335346 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.635062 0.293074 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:15:59.928747 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:00.271528 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:06.910874 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:07.255434 3.000284 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:16:11.707568 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:16:13.670368 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 201 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:14.261325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:21.912393 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 311 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:22.262496 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:28.411906 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:36.853494 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:38.265716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:42.111605 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:47.409021 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:16:56.191480 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:00.707844 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:17:01.549301 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:10.272074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:17:10.432659 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:17:15.679642 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:23:14.279141 3.000558 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:23:21.284846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:29.286802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:45.289824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:24:17.295610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:21.302831 3.000773 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:30:28.308714 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:36.310765 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:52.313529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:31:24.319779 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:28.327273 2.999868 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:37:35.332846 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:43.334912 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:59.337213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:38:31.343465 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:35.351151 2.999968 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:44:42.356934 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:50.358622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:06.361226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:38.367573 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:47:27.564738 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:47:27.565045 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:47:44.298644 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:03.140560 0.178756 tcp 10.0.2.16 49693 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:03.319425 0.209115 tcp 10.0.2.16 49694 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:03.529558 0.178283 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 361 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.708379 0.113116 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 485 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.708812 2.992020 tcp 10.0.2.16 49695 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:48:03.820701 0.097236 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 300 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 13:48:03.918441 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:12.699434 0.000000 tcp 10.0.2.16 49695 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 13:48:21.912591 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:24.707417 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:29.714274 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:34.721054 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 13:48:38.888102 0.176597 tcp 10.0.2.16 49696 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:48:39.065272 0.210165 tcp 10.0.2.16 49697 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:51:42.372735 3.002316 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:51:49.380865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:51:57.382230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:13.385189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:45.391502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:58:49.399588 2.999359 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:58:56.405238 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:04.406695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:20.409713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:52.415455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:05:56.422975 2.999866 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:06:03.429031 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:11.430334 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:27.433088 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:59.439494 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:03.447031 3.000365 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:13:10.452531 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:18.454167 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:34.457368 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:14:06.463191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:18:51.513599 0.000135 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:18:51.513929 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:07.906869 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:24.205220 0.179754 tcp 10.0.2.16 49698 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:24.385455 0.204258 tcp 10.0.2.16 49699 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:24.590754 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:42.206438 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:19:57.820746 0.178003 tcp 10.0.2.16 49700 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:57.999133 0.204763 tcp 10.0.2.16 49701 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:19:58.204915 0.113243 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.317259 0.173679 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 332 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.317840 3.005668 tcp 10.0.2.16 49702 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:19:58.491644 0.098825 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 379 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:19:58.591154 0.172255 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 536 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:01.764336 0.179093 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 571 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:04.939144 0.520119 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1223 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:05.459909 0.292577 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1310 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:05.753080 0.333501 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1411 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:06.085531 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:07.322307 0.000000 tcp 10.0.2.16 49702 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:20:10.470977 3.000123 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:20:12.700610 0.172012 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 374 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:15.874989 0.521250 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:16.396841 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:17.477011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:19.319978 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:24.326744 4.450813 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1880 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:25.267997 0.179505 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 526 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:25.477973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:28.776873 0.294117 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:20:29.071604 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:29.333928 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:37.435679 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:41.481145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:42.202010 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:20:44.736607 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:20:52.327173 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:00.378546 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:05.415914 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:12.816855 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:13.487153 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:21:20.687865 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:25.204475 0.000129 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:21:26.016927 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:34.998947 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:42.699940 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:21:49.910084 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:27:17.494900 2.999792 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:27:24.500842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:32.502373 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:48.505523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:28:20.511092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:24.519044 2.999897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:34:31.525065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:39.525923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:55.529305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:35:27.535506 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:41:31.542807 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:41:38.549210 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:41:46.550005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:02.553685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:34.559409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:48:38.566652 3.000728 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:48:45.572693 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:48:53.574540 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:09.576862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:41.583596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:52:04.309004 0.000080 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:52:04.309194 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:20.081090 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:35.948496 0.178902 tcp 10.0.2.16 49703 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:52:36.127649 0.203979 tcp 10.0.2.16 49704 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:52:36.332584 0.171921 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 347 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:52:36.505220 0.112760 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 792 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:52:36.505812 2.993266 tcp 10.0.2.16 49705 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:52:36.617139 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:45.507487 0.000000 tcp 10.0.2.16 49705 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:52:55.512181 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:52:57.505242 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:02.512405 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:07.519646 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:13.440480 0.181203 tcp 10.0.2.16 49706 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:53:13.621504 0.210005 tcp 10.0.2.16 49707 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:53:13.832533 0.097425 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 282 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 14:53:13.930870 3.001986 tcp 10.0.2.16 49708 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:53:22.931601 0.000000 tcp 10.0.2.16 49708 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 14:53:34.929188 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:39.935844 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:53:44.943888 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 268 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 14:55:45.590348 3.001122 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:55:52.596701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:00.598202 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:16.601068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:48.607197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:02:52.615292 3.000029 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:02:59.620444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:07.622443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:23.624993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:55.631156 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:09:59.636942 3.001938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:10:06.644968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:14.646084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:30.648747 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:11:02.655527 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:06.663371 2.999094 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:17:13.668485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:21.669973 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:37.673275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:18:09.679143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:23:28.317946 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:23:28.318271 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:23:44.049903 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:01.019673 0.182559 tcp 10.0.2.16 49709 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:01.201896 0.207370 tcp 10.0.2.16 49710 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:01.410241 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:13.687069 2.999904 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:24:19.351405 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:20.692812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:28.693788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:36.807720 0.177739 tcp 10.0.2.16 49711 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:36.985756 0.206158 tcp 10.0.2.16 49712 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:24:37.192963 0.173636 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.367403 0.113638 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 566 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.367973 2.992783 tcp 10.0.2.16 49713 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:24:37.480180 0.097138 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 301 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:37.577986 0.176766 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:40.751402 0.173557 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 501 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:43.926337 0.339017 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1667 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.264416 0.292296 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1288 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.557215 0.522385 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1379 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:44.697130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:45.080152 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:24:46.359635 0.000000 tcp 10.0.2.16 49713 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:24:52.658998 0.176471 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:55.833466 2.533852 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1218 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:24:56.355520 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:03.374306 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 250 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:03.624153 0.171818 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 386 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:06.799146 0.339086 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1574 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:07.137390 0.295221 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1429 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:25:07.433216 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 302 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:08.381460 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:15.701546 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 314 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:16.702796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:25:20.708832 0.000161 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:25:23.633132 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:30.412777 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:39.115627 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:46.776553 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:25:54.797918 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 306 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:00.426513 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:05.203050 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:26:09.068441 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:17.600998 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:26.072795 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:26:34.334632 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:31:20.710668 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:31:27.716834 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:35.717787 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:51.721119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:32:23.726937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:27.734979 2.999379 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:38:34.740835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:42.741865 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:58.744745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:39:30.751067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:45:34.756919 3.001601 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:45:41.764392 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:45:49.766273 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:05.768988 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:37.775155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:52:41.782303 3.000227 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:52:48.788460 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:52:56.789601 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:12.792658 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:44.799082 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:57:02.383610 0.000152 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:57:02.383920 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:18.145538 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:35.274934 0.178179 tcp 10.0.2.16 49714 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:57:35.453598 0.207229 tcp 10.0.2.16 49715 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:57:35.661824 0.178981 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:57:35.841442 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:35.842015 3.003341 tcp 10.0.2.16 49716 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:57:44.844247 0.000000 tcp 10.0.2.16 49716 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 15:57:52.094944 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:57:56.841513 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:01.848603 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:06.856248 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 217 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 15:58:10.213056 0.177430 tcp 10.0.2.16 49717 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:58:10.391002 0.203595 tcp 10.0.2.16 49718 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:58:10.595647 0.099834 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:58:10.696085 0.118320 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 655 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 15:59:48.804806 3.001968 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:59:55.812369 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:03.813773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:19.816713 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:51.823053 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:06:55.831137 2.999096 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:07:02.836232 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:10.837966 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:26.840559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:58.847056 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:02.854409 2.999947 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:14:09.860599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:17.861532 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:33.864563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:15:05.871471 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:09.879036 2.999812 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:21:16.884282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:24.885998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:40.888607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:22:12.894892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:16.900237 3.002472 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:28:23.908295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:26.241591 0.000198 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:28:26.241952 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:28:31.909802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:43.426170 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:28:47.912548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:01.406586 0.177434 tcp 10.0.2.16 49719 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:01.584559 0.205699 tcp 10.0.2.16 49720 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:01.791501 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:18.356670 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:19.918996 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:35.684146 0.176893 tcp 10.0.2.16 49721 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:35.861596 0.208494 tcp 10.0.2.16 49722 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:29:36.070656 0.177689 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.249019 0.113843 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.249582 2.997223 tcp 10.0.2.16 49723 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 16:29:36.362248 0.096641 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 219 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:36.459826 0.174377 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:39.637257 0.180209 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 597 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:42.821701 0.338150 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1486 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.159603 0.293174 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.453282 0.535701 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1314 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:43.989579 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:45.245279 0.000000 tcp 10.0.2.16 49723 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 16:29:50.312564 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:29:55.670194 0.172874 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:57.242749 2.135417 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1142 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:29:59.378745 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:02.250148 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:04.462751 0.179271 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 580 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:07.257455 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:07.638060 0.339730 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1730 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:07.976960 0.293843 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1438 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 16:30:08.271638 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:13.886266 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:18.703153 0.000195 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:30:20.866658 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 263 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:28.928587 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:34.906478 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:40.174282 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:45.461983 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 170 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:30:54.154774 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:01.394993 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:06.201696 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:31:07.383682 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:14.954573 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:31:21.333240 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 16:35:23.926227 3.000416 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 16:35:30.932428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:35:38.933734 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:35:54.937033 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:36:26.942825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:42:30.950778 2.999328 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:42:37.955870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:42:45.957445 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:01.961048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:33.967070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:37.974645 2.999854 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:49:44.980330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:52.981770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:08.984925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:40.990646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:56:44.998361 3.000289 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:56:52.003850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:00.005873 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:16.008933 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:48.016147 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:01:35.672324 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:01:35.672645 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:01:52.606887 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:10.115933 0.177231 tcp 10.0.2.16 49724 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:10.293662 0.215341 tcp 10.0.2.16 49725 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:10.510029 0.176462 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 370 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:02:10.687169 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:10.687757 2.998906 tcp 10.0.2.16 49726 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:02:19.685529 0.000000 tcp 10.0.2.16 49726 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:02:28.227807 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:31.682975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 147 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:36.689774 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:41.696910 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:02:44.873536 0.177478 tcp 10.0.2.16 49727 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:45.051430 0.210656 tcp 10.0.2.16 49728 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:02:45.263157 0.097446 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:02:45.361149 0.126326 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 625 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:03:52.022810 3.000647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 17:03:59.028127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:07.029755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:23.032311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:55.038362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:10:59.046619 2.999675 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:11:06.052001 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:14.053629 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:30.056466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:12:02.062359 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:06.070017 2.999859 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:18:13.075944 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:21.077416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:37.080459 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:19:09.086452 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:13.094014 3.000051 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:25:20.099718 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:28.101198 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:44.104285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:26:16.110485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:20.117722 3.000298 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:32:27.123647 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:35.125395 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:46.752255 0.000139 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:32:46.752546 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:32:51.128183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:33:04.027581 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:22.668672 0.177859 tcp 10.0.2.16 49729 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:22.846783 0.207085 tcp 10.0.2.16 49730 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:23.054960 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:23.134397 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:33:40.069176 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 100 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:33:55.172780 0.176206 tcp 10.0.2.16 49731 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:55.349303 0.202854 tcp 10.0.2.16 49732 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:33:55.553114 0.175151 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.728891 0.154177 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 724 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.729465 3.006166 tcp 10.0.2.16 49733 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:33:55.882114 0.096944 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:55.979792 0.173053 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 432 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:33:59.156659 0.176999 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 449 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:02.330860 0.466468 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1606 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:02.796880 0.523429 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:03.320860 0.298322 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1304 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:03.619757 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 298 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:04.734390 0.000000 tcp 10.0.2.16 49733 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 17:34:10.503479 0.187279 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 505 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 17:34:16.731744 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:21.739156 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:34:26.745749 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 17:39:27.141889 3.000403 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 17:39:34.147610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:42.149263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:58.152610 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:40:30.158357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:46:34.166308 2.999974 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:46:41.171904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:46:49.172949 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:05.176352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:37.182181 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:53:41.189856 3.000090 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:53:48.195901 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:53:56.197658 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:12.200656 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:44.206216 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:00:48.214168 3.000526 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:00:55.220222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:03.222155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:19.224338 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:51.230611 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:04:35.677096 0.000178 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:04:35.677437 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:04:54.233999 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 225 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:10.742112 0.176652 tcp 10.0.2.16 49734 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:10.919131 0.203201 tcp 10.0.2.16 49735 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:11.123372 0.164651 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 596 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:11.287114 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:11.288296 3.004066 tcp 10.0.2.16 49736 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:05:20.290503 0.000000 tcp 10.0.2.16 49736 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:05:26.930530 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:32.288519 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:37.295765 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:42.302504 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:05:43.256138 0.186629 tcp 10.0.2.16 49737 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:43.443414 0.220748 tcp 10.0.2.16 49738 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:05:43.665293 0.138896 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:43.804815 0.180150 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 258 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:05:43.985614 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:06:01.570284 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:06:17.295518 0.177826 tcp 10.0.2.16 49739 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:06:17.473731 0.210273 tcp 10.0.2.16 49740 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:07:55.297906 3.000231 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:08:02.304002 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:10.305270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:26.308784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:58.314711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:02.321610 3.000388 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:15:09.327875 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:17.329319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:33.332617 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:16:05.338154 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:09.345856 3.000430 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:22:16.352039 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:24.353350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:40.356326 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:23:12.362493 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:16.370184 3.000020 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:29:23.376028 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:31.377299 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:47.380363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:30:19.386562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:23.393652 3.000361 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:36:27.055725 0.000179 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:36:27.056068 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:36:30.399728 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:38.401239 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:45.892801 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:36:54.403935 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:02.651082 0.177172 tcp 10.0.2.16 49741 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:37:02.828595 0.213236 tcp 10.0.2.16 49742 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:37:03.042386 4.759980 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2044 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.166615 3.738724 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.166990 2.994056 tcp 10.0.2.16 49743 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:37:03.264322 4.163837 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:03.440185 0.174124 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 407 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:07.801749 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:12.160017 0.000000 tcp 10.0.2.16 49743 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 18:37:14.142554 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:20.136900 0.173617 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 461 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:23.306020 0.523918 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1086 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:23.830333 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:24.166981 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:26.410425 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:29.174226 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:31.297274 0.176339 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:34.181798 0.667246 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1798 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 18:37:34.848228 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:43.655101 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:48.261272 0.000165 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:37:51.396564 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:37:59.748536 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:08.060672 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:14.399436 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:21.029480 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:29.441182 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 313 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:34.257753 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:38:35.169555 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:43.400865 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:51.973350 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:38:58.132660 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:39:03.280345 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 18:43:30.417529 3.000533 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:43:37.423739 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:43:45.425260 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:01.428410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:33.434162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:50:37.442207 2.999988 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:50:44.447547 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:50:52.449117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:08.452442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:40.458456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:57:44.465635 3.000436 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:57:51.471782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:57:59.472947 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:15.476151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:47.482133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:04:51.489382 3.000474 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:04:58.495789 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:06.497014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:22.500342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:54.505776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:09:35.514420 0.000147 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:09:35.514727 0.179988 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 378 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:09:35.695429 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:09:35.696159 3.002088 tcp 10.0.2.16 49744 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:09:44.706867 0.000000 tcp 10.0.2.16 49744 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:09:52.037983 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:09:56.705173 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:01.711414 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:06.719073 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:07.534699 0.176825 tcp 10.0.2.16 49745 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:07.712004 0.207383 tcp 10.0.2.16 49746 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:07.920340 0.119844 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:10:08.039692 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:25.856760 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:10:43.994852 0.176844 tcp 10.0.2.16 49747 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:10:44.171947 0.204605 tcp 10.0.2.16 49748 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:11:58.514649 2.999108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:12:05.519272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:13.520945 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:29.524456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:13:01.530174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:05.537376 3.000779 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:19:12.543705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:20.544837 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:36.547915 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:20:08.553723 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:12.561656 2.999928 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:26:19.567350 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:27.569362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:43.572133 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:27:15.578191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:19.585394 2.999862 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:33:26.591825 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:34.593193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:50.596431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:34:22.601781 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:26.607999 3.001400 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:40:33.615696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:41.617159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:57.619764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:07.444171 0.000137 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:41:07.444448 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:22.646361 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:29.626065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:40.897384 0.177440 tcp 10.0.2.16 49749 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:41:41.075153 0.209708 tcp 10.0.2.16 49750 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:41:41.285873 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:41:59.899584 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:17.527038 0.179793 tcp 10.0.2.16 49751 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:42:17.707020 0.209027 tcp 10.0.2.16 49752 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:42:17.917050 0.173947 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:18.091665 0.120144 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 769 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:18.092216 2.987918 tcp 10.0.2.16 49753 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:42:18.212074 0.176408 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 662 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:21.390767 0.174907 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 535 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:24.564773 0.354853 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1489 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:24.919303 0.517241 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1258 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:25.437057 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:27.078727 0.000000 tcp 10.0.2.16 49753 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 19:42:33.758128 0.292525 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1372 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:34.051126 0.174730 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 599 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 19:42:39.086384 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 122 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:44.093531 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:42:49.100752 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 19:47:33.633147 3.000186 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:47:40.639134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:47:48.640788 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:04.644150 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:36.649802 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:54:40.657122 3.000368 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:54:47.662961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:54:55.664884 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:11.667641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:43.674091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:01:47.681723 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:01:54.687055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:02.688590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:18.691817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:50.698134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:08:54.705337 3.000251 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:09:01.711411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:09.713155 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:25.716076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:57.721892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:12:47.506619 0.000148 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:12:47.506925 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:04.631109 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:20.078651 0.459123 tcp 10.0.2.16 49754 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:20.538250 0.471812 tcp 10.0.2.16 49755 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:21.010624 0.132792 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 503 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:21.142709 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:21.143839 2.994677 tcp 10.0.2.16 49756 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:13:30.147701 0.000000 tcp 10.0.2.16 49756 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:13:36.626384 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:42.155178 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:47.161787 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:52.168854 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:13:53.883927 0.882699 tcp 10.0.2.16 49757 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:54.767097 0.953184 tcp 10.0.2.16 49758 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:13:55.721274 0.661239 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 344 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:56.383096 0.547134 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:13:56.930832 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:14:14.260711 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:14:30.486395 0.263801 tcp 10.0.2.16 49759 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:14:30.750715 0.340180 tcp 10.0.2.16 49760 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:16:01.729154 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:16:08.735300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:16.736497 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:32.739614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:17:04.745885 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:08.753363 3.000391 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:23:15.758809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:23.760693 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:39.764040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:24:11.769451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:15.777062 3.000308 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:30:22.783422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:30.784593 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:46.787687 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:31:18.793923 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:22.800924 3.000402 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:37:29.807444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:37.808420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:53.811824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:38:25.817850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:29.826572 2.998488 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:44:36.831026 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:44.832709 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:51.782741 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:44:51.783057 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:00.835334 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:08.757510 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:24.802893 0.179063 tcp 10.0.2.16 49761 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:45:24.982387 0.212058 tcp 10.0.2.16 49762 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:45:25.195521 4.712374 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2016 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.309756 3.967340 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.310337 3.004712 tcp 10.0.2.16 49763 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:45:25.483834 4.085088 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1346 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:25.581554 0.176741 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:29.907658 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:32.841804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:34.313676 0.000000 tcp 10.0.2.16 49763 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 20:45:38.790133 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:46.311732 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:47.713313 0.178019 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:50.888038 0.519342 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1130 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:51.318452 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:51.407941 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:45:56.325231 4.664114 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1709 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:45:57.477270 0.175827 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 637 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:46:00.989664 0.294770 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1217 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 20:46:01.284867 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 289 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:06.259364 0.000163 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:46:09.604602 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:17.476210 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:25.136967 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:32.537602 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 172 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:39.727691 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:45.837014 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:46:50.763445 0.000111 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:46:53.728045 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:01.609066 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:08.299043 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:15.128885 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:47:20.907459 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 20:51:36.849214 2.999746 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:51:43.854979 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:51:51.856265 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:07.859829 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:39.865560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:58:43.872728 3.000135 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:58:50.879443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:58:58.880551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:14.883776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:46.889476 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:05:50.897530 2.999774 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:05:57.903097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:05.904210 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:21.907686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:53.913637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:12:57.921326 3.000147 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:13:04.926648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:12.928403 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:28.931066 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:14:00.937740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:17:45.761418 0.000148 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:17:45.761735 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:01.644070 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:20.074930 0.181867 tcp 10.0.2.16 49764 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:20.257338 0.209033 tcp 10.0.2.16 49765 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:20.467391 0.178641 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:18:20.646721 0.122744 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 604 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:18:20.647346 2.997744 tcp 10.0.2.16 49766 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:18:20.768974 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:29.643902 0.000000 tcp 10.0.2.16 49766 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:18:38.356752 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:41.641101 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:46.648735 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:51.655867 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 266 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:18:53.941274 0.242521 tcp 10.0.2.16 49767 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:54.184302 0.272785 tcp 10.0.2.16 49768 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:18:54.458050 0.106394 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 275 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:20:04.944717 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:20:11.950509 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:19.952274 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:35.954992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:21:07.961224 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:11.969186 3.000339 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:27:18.975114 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:26.976686 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:42.979267 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:28:14.985798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:18.993171 3.000201 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:34:25.999183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:34.000772 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:50.003304 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:35:22.009000 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:26.017153 3.000197 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:41:33.022822 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:41.024696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:57.027562 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:42:29.033478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:33.041589 3.000190 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:48:40.046998 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:48.048191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:59.084400 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:48:59.084703 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:04.051071 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:17.029795 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:34.568432 0.172443 tcp 10.0.2.16 49769 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:49:34.740775 0.203763 tcp 10.0.2.16 49770 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:49:34.945102 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:49:36.057005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:51.229238 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:09.036346 0.172163 tcp 10.0.2.16 49771 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:50:09.209098 0.206824 tcp 10.0.2.16 49772 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:50:09.416462 0.172394 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.589537 0.115356 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 603 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.590142 2.989788 tcp 10.0.2.16 49773 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:50:09.704338 0.095306 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 392 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:09.800406 0.171626 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 540 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:12.970605 0.174547 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 576 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.144874 0.344776 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.488816 0.288501 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1208 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:16.777952 0.518548 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1255 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:17.297083 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:18.578012 0.000000 tcp 10.0.2.16 49773 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 21:50:25.248481 0.176502 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 602 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 21:50:30.585799 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:35.592742 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:50:40.600328 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 21:55:40.065123 2.999637 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:55:47.071914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:55:55.073351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:11.075812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:43.081522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:02:47.089056 2.999792 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:02:54.094354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:02.096411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:18.099508 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:50.105356 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:09:54.113192 3.000110 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:10:01.118898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:09.119840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:25.123456 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:57.128932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:01.137021 3.000084 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:17:08.143062 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:16.144218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:32.146866 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:18:04.152804 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:20:49.371433 0.000113 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:20:49.371616 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:06.094642 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:24.005501 0.172596 tcp 10.0.2.16 49774 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:24.178381 0.204613 tcp 10.0.2.16 49775 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:24.384013 0.121241 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 744 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:24.504537 0.097082 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 406 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:24.505640 2.999463 tcp 10.0.2.16 49776 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:21:24.602187 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 145 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:33.504328 0.000000 tcp 10.0.2.16 49776 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:21:40.524303 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:45.502105 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:50.509205 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:55.515913 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:21:56.409093 0.172708 tcp 10.0.2.16 49777 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:56.582218 0.204368 tcp 10.0.2.16 49778 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:21:56.787617 0.169367 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 283 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:21:56.957567 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:22:13.511585 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:22:28.674586 0.172476 tcp 10.0.2.16 49779 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:22:28.847554 0.204550 tcp 10.0.2.16 49780 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:24:08.158973 3.001517 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:24:15.166756 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:23.168197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:39.171434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:25:11.177083 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:15.184666 3.000519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:31:22.190745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:30.192098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:46.194730 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:32:18.200843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:22.208837 3.000499 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:38:29.214584 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:37.215992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:53.218874 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:39:25.225309 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:29.232758 3.000087 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:45:36.238428 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:44.240149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:00.243498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:32.249085 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:36.256987 3.000196 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:52:42.051025 0.000298 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:52:42.051476 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:52:43.262423 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:51.264014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:57.272887 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 293 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:07.267162 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:15.443622 1.933967 tcp 10.0.2.16 49781 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:53:15.617606 0.200167 tcp 10.0.2.16 49782 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:53:15.818756 3.888624 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2474 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:15.929167 4.572382 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:15.930233 3.003156 tcp 10.0.2.16 49783 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:16.025324 4.191538 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1513 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:16.195955 0.180185 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:20.502062 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:24.931979 0.000000 tcp 10.0.2.16 49783 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:27.797056 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:35.738238 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:36.929988 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:39.273763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:41.937188 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:44.009763 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:46.944093 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:49.988310 0.177488 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 545 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:53.163004 0.523589 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1270 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:53:53.687381 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:53:53.687981 3.009917 tcp 10.0.2.16 49784 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:53:57.759520 0.000076 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:53:59.892780 0.170834 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 484 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:02.706303 0.000000 tcp 10.0.2.16 49784 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 22:54:03.067210 0.340547 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1643 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:03.407055 0.285514 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1216 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 22:54:03.693211 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:12.320654 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:14.704799 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:19.711567 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:20.252450 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:24.719190 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 251 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:27.382069 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:33.190561 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:40.181054 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:44.757112 0.000122 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:54:47.131127 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:54:54.441595 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 186 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:02.913762 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:10.133732 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:17.474715 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:24.694796 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 22:55:29.261184 0.000117 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:59:43.280875 2.999470 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:59:50.286372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:59:58.287851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:14.291042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:46.297377 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:06:50.304569 2.999726 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:06:57.309989 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:05.312109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:21.315433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:53.321100 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:13:57.326677 3.001776 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:14:04.334348 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:12.336012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:28.339125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:15:00.344744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:04.352415 3.000228 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:21:11.358775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:19.359708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:35.362661 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:22:07.368697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:25:48.366872 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:25:48.367214 0.174559 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:25:48.542419 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:25:48.543114 2.997654 tcp 10.0.2.16 49785 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:25:57.539617 0.000000 tcp 10.0.2.16 49785 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:26:06.793336 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:09.547431 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:14.554074 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:19.561461 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:22.410007 0.173726 tcp 10.0.2.16 49786 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:22.584276 0.226066 tcp 10.0.2.16 49787 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:22.811418 0.125714 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 422 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:26:22.936530 0.095089 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 212 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:26:23.032180 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:41.884151 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:26:59.180516 0.171299 tcp 10.0.2.16 49788 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:26:59.352182 0.212805 tcp 10.0.2.16 49789 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:28:11.376274 3.000497 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 23:28:18.382143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:26.384288 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:42.386812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:29:14.392552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:18.400778 2.999460 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:35:25.406014 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:33.407425 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:49.411142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:36:21.417006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:25.424450 3.000249 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:42:32.430285 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:40.431632 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:56.434688 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:43:28.440970 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:49:32.448358 3.000022 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:49:39.454312 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:49:47.455605 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:03.458985 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:35.464572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:56:39.472638 2.999838 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:56:46.478047 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:56:54.479380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:02.190878 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:57:02.191284 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:10.483049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:17.853467 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:36.434550 0.174523 tcp 10.0.2.16 49790 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:57:36.609460 0.272211 tcp 10.0.2.16 49791 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:57:36.882645 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:57:42.488362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:53.013930 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:11.653212 0.181254 tcp 10.0.2.16 49792 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:58:11.834861 0.208284 tcp 10.0.2.16 49793 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:58:12.044142 0.179589 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 221 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.224240 0.118728 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.224590 3.001132 tcp 10.0.2.16 49794 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:58:12.342425 0.095871 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:12.438984 0.171333 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 440 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:15.606425 0.173710 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 518 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:18.781195 0.335873 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.116256 0.289424 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1341 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.406252 0.511188 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1167 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:19.917999 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:21.223998 0.000000 tcp 10.0.2.16 49794 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/03 23:58:28.474652 0.171182 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:31.649852 1.572533 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1585 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:32.163073 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:38.229174 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:39.541019 0.173531 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 539 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:42.715296 0.338698 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1594 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:43.053267 0.297772 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/03 23:58:43.236355 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:43.351716 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:51.718540 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:58:56.254543 0.000114 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:58:56.845274 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:03.275710 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:09.403745 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:16.093397 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:21.751562 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:28.721537 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:36.923651 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:41.760145 0.000132 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:59:45.295589 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:50.332563 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/03 23:59:57.232787 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:03:46.496282 3.000376 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 00:03:53.502568 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:01.504106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:17.506325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:49.512228 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:10:53.520144 3.000271 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:11:00.525720 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:08.527333 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:24.530877 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:56.537211 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:00.544173 3.000118 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:18:07.550112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:15.551443 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:31.554357 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:19:03.560342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:07.568425 2.999536 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:25:14.574097 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:22.575563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:38.578123 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:26:10.584346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:30:24.419980 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:30:24.420327 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:40.633494 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:56.330050 0.177755 tcp 10.0.2.16 49795 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:30:56.508101 0.207707 tcp 10.0.2.16 49796 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:30:56.716889 0.182828 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:30:56.900398 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:30:56.901019 2.999490 tcp 10.0.2.16 49797 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 00:31:05.899376 0.000000 tcp 10.0.2.16 49797 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 00:31:12.749219 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:17.907059 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 106 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:22.913968 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:27.921273 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 00:31:28.173140 0.177010 tcp 10.0.2.16 49798 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:31:28.350421 0.208093 tcp 10.0.2.16 49799 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:31:28.559533 0.102060 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 242 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:31:28.662257 0.116156 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 703 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 00:32:14.592116 2.999704 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 00:32:21.597862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:29.599856 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:45.602378 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:33:17.608542 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:21.616472 3.000106 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:39:28.622197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:36.623563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:52.626604 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:40:24.632463 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:28.641464 2.998633 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:46:35.645725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:43.647842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:59.650261 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:47:31.656101 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:53:35.664234 2.999724 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:53:42.670037 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:53:50.671418 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:06.674597 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:38.680782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:00:42.688254 3.000008 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:00:49.693706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:00:57.695325 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:13.698461 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:31.394083 0.000186 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:01:31.394462 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:01:45.704080 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:49.980770 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 245 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:05.717959 1.627135 tcp 10.0.2.16 49800 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:07.345616 1.784764 tcp 10.0.2.16 49801 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:09.131429 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:27.203945 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:02:45.893532 3.961126 tcp 10.0.2.16 49802 -> 173.194.70.106 80 FSPA* 0 0 11 1872 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:47.567623 1.785365 tcp 10.0.2.16 49803 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:02:49.354007 1.016393 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 391 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:50.371129 0.907127 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 692 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:50.371812 2.999765 tcp 10.0.2.16 49804 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:02:51.277616 0.888962 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:52.177496 0.942998 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:56.115606 0.958073 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:02:59.370324 0.000000 tcp 10.0.2.16 49804 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:00.072445 2.895302 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1373 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:02.968340 2.695172 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1442 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:05.662759 2.643349 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1223 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:08.306744 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:11.377644 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:16.265211 0.963976 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 537 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:16.385104 4.823596 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 4 754 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:21.391787 1.804845 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 4 783 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:23.197349 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:30.094725 0.960271 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:34.050388 2.755452 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1651 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:34.760767 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:03:36.805521 2.671930 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1138 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:03:36.806410 2.992325 tcp 10.0.2.16 49805 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:39.478292 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:45.807532 0.000000 tcp 10.0.2.16 49805 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:03:45.867079 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:54.329355 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:03:57.814434 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:00.307892 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:02.821763 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:06.948071 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:07.829018 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 99 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:12.845795 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:17.763044 0.000285 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:04:18.654642 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 180 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:27.397189 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 199 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:32.768504 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:41.166781 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:47.856580 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:04:53.424142 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:07:49.712067 3.000110 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:07:56.717931 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:04.719578 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:20.722170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:52.728585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:14:56.735703 3.000462 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:15:03.741766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:11.742948 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:27.746351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:59.752032 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:03.760122 3.000119 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:22:10.765512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:18.766853 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:34.770057 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:23:06.776180 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:10.783789 3.000538 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:29:17.789919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:25.791488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:41.793830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:30:13.800585 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:35:27.181390 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:35:27.181721 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:35:43.384408 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:01.885066 0.198117 tcp 10.0.2.16 49806 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:02.083776 0.207182 tcp 10.0.2.16 49807 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:02.292049 0.176845 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 401 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:02.469553 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:02.470166 2.995399 tcp 10.0.2.16 49808 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:36:11.464712 0.000000 tcp 10.0.2.16 49808 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 01:36:17.807976 3.000181 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:36:18.254597 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:23.462345 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:24.813337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:36:28.468875 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:32.815525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:36:33.476655 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 01:36:36.181381 0.187693 tcp 10.0.2.16 49809 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:36.369337 0.212172 tcp 10.0.2.16 49810 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:36:36.582060 0.124325 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 466 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:36.706712 0.097096 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 320 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 01:36:48.817920 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:37:20.824408 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:24.831714 3.000156 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:43:31.837586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:39.839331 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:55.841903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:44:27.847820 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:50:31.855742 3.000395 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:50:38.861819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:50:46.862757 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:02.865920 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:34.872225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:57:38.877533 3.002177 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:57:45.885243 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:57:53.886761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:09.889875 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:41.896324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:04:45.903761 2.999884 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:04:52.909630 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:00.910768 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:16.914363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:48.919689 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:06:50.989654 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:06:50.989986 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:09.906853 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:27.926836 0.171555 tcp 10.0.2.16 49811 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:07:28.098740 0.207758 tcp 10.0.2.16 49812 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:07:28.307551 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:07:45.517994 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:01.292580 0.171809 tcp 10.0.2.16 49813 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:08:01.464852 0.205137 tcp 10.0.2.16 49814 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:08:01.671117 0.170588 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 364 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:01.842322 0.123916 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 654 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:01.842883 3.002798 tcp 10.0.2.16 49815 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:08:01.965560 0.096089 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 390 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:02.062335 0.173352 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:05.236395 0.176571 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:08.410836 0.383582 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:08.793713 0.525119 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:09.319352 0.384889 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1256 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:09.704783 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:10.843706 0.000000 tcp 10.0.2.16 49815 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:08:15.595235 0.345977 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:18.946309 3.895462 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:19.776083 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:26.656818 0.445580 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 452 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:27.848692 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:30.102598 0.366368 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1530 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:30.468276 0.285739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1478 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:08:30.754472 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:32.855663 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:38.053097 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:42.759735 0.000173 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:08:46.135184 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:08:53.885962 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:02.408395 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 309 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:09.918956 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:15.537759 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:22.867816 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:27.754821 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:09:30.318717 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:37.619018 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:43.387536 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:09:51.108769 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:11:52.927685 3.000262 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 02:11:59.933776 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:07.934551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:23.937753 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:55.943906 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:18:59.951627 2.999987 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:19:06.957805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:14.958986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:30.962319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:20:02.968353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:06.975762 3.000060 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:26:13.981035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:21.982992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:37.985902 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:27:09.991642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:13.999683 2.999645 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:33:21.005263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:29.007414 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:45.010069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:34:17.015795 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:10.688887 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:40:10.689172 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:21.023355 2.999944 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:40:28.028993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:29.681671 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:36.031005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:48.132556 0.172274 tcp 10.0.2.16 49816 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:40:48.305356 0.204027 tcp 10.0.2.16 49817 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:40:48.510402 0.218747 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 349 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.729776 0.123778 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 673 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.730352 3.003187 tcp 10.0.2.16 49818 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:40:48.852946 0.097587 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 334 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 02:40:48.951078 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:40:52.034091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:57.732006 0.000000 tcp 10.0.2.16 49818 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 02:41:04.211632 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:09.729407 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 94 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:14.737000 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:19.744293 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 02:41:19.746733 0.171367 tcp 10.0.2.16 49819 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:41:19.918372 0.225327 tcp 10.0.2.16 49820 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:41:24.040485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:28.047642 2.999881 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:47:35.053695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:43.054676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:59.057830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:48:31.063729 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:54:35.071901 3.000659 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:54:42.078664 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:54:50.079068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:06.081480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:38.087841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:01:42.093666 3.001961 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:01:49.101515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:01:57.102810 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:13.105516 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:45.111595 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:08:49.119675 3.000052 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:08:56.125024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:04.126986 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:20.129565 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:52.136109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:11:45.749985 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:11:45.750280 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:01.572262 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:19.011773 0.172866 tcp 10.0.2.16 49821 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:19.184926 0.210999 tcp 10.0.2.16 49822 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:19.396939 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:37.513416 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:12:56.422680 0.174868 tcp 10.0.2.16 49823 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:56.598107 0.208650 tcp 10.0.2.16 49824 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:12:56.807763 0.131388 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 614 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:56.938595 0.269314 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:56.939774 3.006005 tcp 10.0.2.16 49825 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:12:57.208504 0.095415 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 268 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:12:57.304740 0.266612 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:00.566709 0.258559 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 421 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:03.821300 0.384989 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1618 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:04.205495 0.286144 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:04.492171 0.795997 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:05.288748 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:05.944805 0.000000 tcp 10.0.2.16 49825 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:13:13.916019 0.264694 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:17.180556 0.803350 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 970 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:17.942163 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:17.984499 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:22.949216 4.991079 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1968 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:24.281470 0.272527 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 636 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:27.939486 0.285546 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:13:27.955873 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:28.225577 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:37.189202 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:41.755656 0.000141 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:13:42.657023 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:51.279690 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 307 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:13:58.960731 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 308 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:04.959776 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:11.358433 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:19.930872 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:24.757944 0.000156 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:14:26.590267 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:33.690920 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:40.901317 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 306 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:14:47.860945 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 132 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:15:56.143585 3.000159 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 03:16:03.149268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:11.150447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:27.153534 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:59.159826 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:03.165307 3.002491 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:23:10.172817 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:18.174336 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:34.177763 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:24:06.183537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:10.191897 2.999699 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:30:17.196740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:25.198421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:41.201444 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:31:13.207396 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:17.215121 3.000388 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:37:24.221365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:32.222871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:48.225618 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:38:20.231420 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:24.239035 3.000070 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:44:31.245179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:39.246380 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:55.249179 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:22.218706 0.000153 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:45:22.219031 0.260587 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 309 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:45:22.480296 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:22.481002 3.001899 tcp 10.0.2.16 49826 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:45:27.255940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:31.481514 0.000000 tcp 10.0.2.16 49826 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:45:41.135620 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:43.478834 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 110 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:48.486557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:53.493835 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 265 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:58.114332 0.172501 tcp 10.0.2.16 49827 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:45:58.287473 0.206587 tcp 10.0.2.16 49828 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:45:58.495028 0.116824 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 647 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:45:58.611016 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:45:58.612434 3.002225 tcp 10.0.2.16 49829 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:46:07.613259 0.000000 tcp 10.0.2.16 49829 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 03:46:14.053450 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:19.611058 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:24.618466 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:29.625661 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 03:46:32.721612 0.177125 tcp 10.0.2.16 49830 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:46:32.899339 0.203887 tcp 10.0.2.16 49831 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:46:33.104297 0.100187 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 308 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 03:51:31.262849 3.000711 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 03:51:38.269544 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:51:46.270775 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:02.273732 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:34.279523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:58:38.287462 2.999431 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:58:45.293040 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:58:53.294233 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:09.297871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:41.303320 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:05:45.310586 3.000345 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:05:52.317225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:00.318134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:16.321104 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:48.327521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:12:52.334830 3.000245 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:12:59.340898 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:07.342520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:23.345102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:55.351523 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:16:42.021353 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:16:42.021685 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:16:57.713490 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:14.983669 0.175979 tcp 10.0.2.16 49832 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:15.159963 0.205383 tcp 10.0.2.16 49833 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:15.366318 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:30.570844 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:48.938811 0.173305 tcp 10.0.2.16 49834 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:49.112625 0.206093 tcp 10.0.2.16 49835 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:17:49.319774 0.273086 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.593529 0.115625 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.594147 2.998188 tcp 10.0.2.16 49836 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:17:49.708376 0.094995 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 325 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:49.804068 0.268051 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 431 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:53.074522 0.270597 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 439 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.348054 0.339588 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1674 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.687110 0.284783 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1131 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:56.972496 0.817838 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1149 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:17:57.790974 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:17:58.591065 0.000000 tcp 10.0.2.16 49836 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:18:04.487000 0.264010 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 553 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:07.754384 2.834547 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:08.540998 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:15.595807 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:17.148145 0.276578 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 475 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:20.422949 0.339857 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:20.602729 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:20.762165 0.286630 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1349 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:18:21.049458 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:27.452763 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:32.259928 0.000072 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:18:34.152122 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:40.852345 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:47.642002 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:18:53.049707 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:01.712289 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:09.453136 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:14.260124 0.000144 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:19:15.571696 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:22.272191 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:28.430183 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:37.043040 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:19:59.359067 3.000354 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:20:06.365095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:14.366337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:30.369059 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:21:02.375711 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:06.382865 3.000130 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:27:13.388564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:21.390092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:37.392944 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:28:09.399560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:13.406982 3.000478 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:34:20.412522 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:28.414447 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:44.417125 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:35:16.423041 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:20.431559 2.999767 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:41:27.436980 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:35.438363 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:51.441431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:42:23.447360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:27.455092 3.000237 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:48:34.460499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:42.462152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:58.465009 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:30.471752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:59.503552 0.000118 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:49:59.503900 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 223 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:15.786575 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:31.022820 0.174504 tcp 10.0.2.16 49837 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:50:31.197619 0.206545 tcp 10.0.2.16 49838 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:50:31.405160 0.265708 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 363 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:50:31.671752 0.114370 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 778 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:50:31.672351 3.000928 tcp 10.0.2.16 49839 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:50:31.785188 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:40.672487 0.000000 tcp 10.0.2.16 49839 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 04:50:47.992628 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:52.670081 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:50:57.676580 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:51:02.683783 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 96 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 04:51:06.701807 0.214152 tcp 10.0.2.16 49840 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:51:06.916350 0.207716 tcp 10.0.2.16 49841 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:51:07.125066 0.097284 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 317 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 04:55:34.478535 3.000525 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:55:41.484840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:55:49.486077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:05.489194 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:37.495170 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:02:41.503255 2.999587 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:02:48.508850 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:02:56.509892 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:12.513343 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:44.518882 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:09:48.527023 3.000005 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:09:55.533030 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:03.534625 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:19.537282 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:51.543127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:16:55.551109 2.999775 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:17:02.556761 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:10.558272 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:26.561337 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:58.567145 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:21:15.109681 0.000127 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:21:15.110013 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:21:32.695176 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:21:49.714407 0.181007 tcp 10.0.2.16 49842 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:21:49.895967 0.204002 tcp 10.0.2.16 49843 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:21:50.100955 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:05.502477 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:21.537451 0.197288 tcp 10.0.2.16 49844 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:22:21.735584 0.226587 tcp 10.0.2.16 49845 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:22:21.962743 0.264109 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.227718 0.116466 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 505 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.228325 3.002111 tcp 10.0.2.16 49846 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:22:22.343627 0.096945 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:22.441291 0.254984 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 597 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:25.691659 0.264438 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 435 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:28.955698 0.345295 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1331 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:29.300102 0.288954 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1189 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:29.589613 0.767334 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1091 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:30.357697 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:31.228828 0.000000 tcp 10.0.2.16 49846 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:22:35.886075 0.264292 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 377 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:39.150849 4.086200 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:39.923695 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:47.432936 0.262857 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 521 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:48.244340 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:50.707880 0.344520 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:51.051966 0.304195 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1276 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:22:51.356759 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 206 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:53.250860 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:22:56.495599 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:03.775792 0.374091 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:04.149883 0.000000 icmp 111.242.171.190 0x0303 -> 10.0.2.16 0xc840 URP 192 1 274 flow=Background 1970/01/04 05:23:08.753279 0.000061 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:23:09.373885 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:16.725119 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 304 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:23.935431 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:32.757860 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:38.676459 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:47.098552 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:51.754619 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:23:52.305607 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 256 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:23:59.395758 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:24:02.574687 3.000034 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:24:04.884065 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 221 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:24:09.581102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:17.581614 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:33.584774 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:25:05.591347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:09.598955 2.999796 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:31:16.604437 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:24.605798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:40.608648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:32:12.614891 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:16.622926 2.999897 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:38:23.628599 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:31.630165 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:47.632922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:39:19.638870 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:23.646563 2.999955 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:45:30.652760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:38.653688 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:54.657303 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:46:26.662840 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:52:30.670436 3.000037 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:52:37.676572 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:52:45.678416 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:01.680784 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:33.687504 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:54:24.330344 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:54:24.330680 0.261479 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 317 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:54:24.592882 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:24.593577 3.001249 tcp 10.0.2.16 49847 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:54:33.592784 0.000000 tcp 10.0.2.16 49847 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:54:43.068266 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:45.590836 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:50.598072 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:55.604775 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:54:58.863927 0.170490 tcp 10.0.2.16 49848 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:54:59.034770 0.204037 tcp 10.0.2.16 49849 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:54:59.239840 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:16.465243 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:33.241415 0.173207 tcp 10.0.2.16 49850 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:55:33.415080 0.203102 tcp 10.0.2.16 49851 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:55:33.619136 0.098214 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 306 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:55:33.717973 0.123781 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 609 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 05:55:33.718526 2.995520 tcp 10.0.2.16 49852 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:55:42.712235 0.000000 tcp 10.0.2.16 49852 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 05:55:54.709975 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:55:59.716792 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:56:04.724409 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 103 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 05:59:37.694604 3.000140 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:59:44.700641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:59:52.702020 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:08.704862 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:40.710985 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:06:44.718587 2.999917 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:06:51.724727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:06:59.725455 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:15.728827 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:47.735109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:13:51.742221 2.999938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:13:58.748248 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:06.749631 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:22.752900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:54.759093 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:20:58.764426 3.002393 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:21:05.772107 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:13.773995 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:29.777201 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:22:01.782530 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:26:02.809462 0.000120 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:26:02.809811 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:17.971486 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:35.210439 0.182780 tcp 10.0.2.16 49853 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:26:35.393587 0.207702 tcp 10.0.2.16 49854 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:26:35.602378 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 252 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:26:53.902774 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:12.151367 0.172948 tcp 10.0.2.16 49855 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:27:12.324808 0.202911 tcp 10.0.2.16 49856 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:27:12.528747 0.264058 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 350 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:12.793521 0.113862 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 631 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:12.794165 2.999690 tcp 10.0.2.16 49857 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:12.906823 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 INT 0 1 117 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:21.793168 0.000000 tcp 10.0.2.16 49857 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:29.604284 0.094739 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 237 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:29.699834 0.259943 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 542 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:32.959288 0.266143 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 446 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:33.790658 3.572502 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1397 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:36.223755 0.338659 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1279 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:37.363543 0.283874 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1047 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:37.647920 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 130 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:38.797750 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:43.123650 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:43.804777 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:50.814572 0.267405 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 515 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:54.079923 0.806926 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1049 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:27:54.887613 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 154 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:27:54.888211 3.006662 tcp 10.0.2.16 49858 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:27:55.751317 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:28:00.298525 0.272515 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:03.573300 0.339514 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1731 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:03.893076 0.000000 tcp 10.0.2.16 49858 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 06:28:03.912499 0.284826 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1289 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:28:04.197936 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:05.788623 3.002254 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 06:28:10.873745 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:12.796205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:15.891386 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 164 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:19.466256 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 212 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:20.797346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:20.897954 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:25.354307 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:25.905532 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:31.924130 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:36.800848 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:37.561913 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:42.258356 0.000083 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:28:45.924179 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:28:54.266195 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 194 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:03.188650 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:08.806940 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:29:11.290666 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:19.031408 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:29:23.758432 0.000117 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:29:24.759917 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 171 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:35:12.814224 3.000108 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:35:19.820257 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:27.822089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:43.824364 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:36:15.830427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:19.838229 3.000498 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:42:26.843851 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:34.845725 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:50.848499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:43:22.854472 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:26.862197 3.000026 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:49:33.868247 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:41.869869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:57.872339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:50:29.878441 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:56:33.885886 3.000433 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:56:40.892008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:56:48.893413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:04.896354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:36.902803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:59:51.807018 0.000140 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:59:51.807395 0.267351 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 293 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 06:59:52.075514 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 06:59:52.076210 2.995175 tcp 10.0.2.16 49859 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:00:01.070240 0.000000 tcp 10.0.2.16 49859 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:00:07.509667 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 279 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:13.077465 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 157 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:18.084873 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 93 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:23.091847 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 111 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:24.818328 0.172569 tcp 10.0.2.16 49860 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:00:24.991191 0.209968 tcp 10.0.2.16 49861 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:00:25.202135 0.122557 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 762 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:00:25.323825 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:00:43.431482 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:00.257239 0.173815 tcp 10.0.2.16 49862 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:01:00.431588 0.210763 tcp 10.0.2.16 49863 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:01:00.644103 0.096950 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 295 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:01:00.741948 2.997694 tcp 10.0.2.16 49864 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:01:09.738411 0.000000 tcp 10.0.2.16 49864 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:01:21.745861 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 272 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:26.753181 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:01:31.760717 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:03:40.909663 3.000608 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:03:47.916345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:03:55.917696 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:11.920434 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:43.926480 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:10:47.934874 2.999196 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:10:54.940029 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:02.941190 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:18.944716 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:50.950911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:17:54.958363 2.999519 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:18:01.964323 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:09.965174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:25.968584 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:57.974525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:01.981774 3.000397 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:25:08.987971 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:16.989079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:32.992654 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:26:04.998695 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:31:09.546345 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:31:09.546677 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:31:27.842499 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 108 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:31:44.491487 0.172527 tcp 10.0.2.16 49865 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:31:44.664475 0.228898 tcp 10.0.2.16 49866 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:31:44.894360 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:02.883379 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:09.004360 3.001490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:32:16.011930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:20.509192 0.172051 tcp 10.0.2.16 49867 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:32:20.681555 0.228188 tcp 10.0.2.16 49868 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:32:20.910729 0.280601 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.192062 0.124040 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 718 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.192678 3.000583 tcp 10.0.2.16 49869 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:32:21.315773 0.096649 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 263 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:21.413094 0.271587 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 522 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:24.013076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:24.685017 0.267495 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 590 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:27.949477 0.371314 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1788 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:28.320185 0.289695 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1215 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:28.610384 0.841793 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1394 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:29.452791 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 205 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:30.191937 0.000000 tcp 10.0.2.16 49869 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 07:32:38.364507 0.269697 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 07:32:40.016400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:42.189858 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:47.197217 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 282 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:32:52.203895 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 07:33:12.022116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:16.030291 3.000123 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:39:23.036484 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:31.037207 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:47.040389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:40:19.046701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:23.054076 3.000272 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:46:30.059798 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:38.061192 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:54.064612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:47:26.071706 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:53:30.079129 2.998982 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:53:37.084015 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:53:45.085256 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:01.088451 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:33.094638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:00:37.102067 2.999576 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:00:44.107913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:00:52.109333 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:08.112235 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:40.118554 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:03:08.085870 0.000130 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:03:08.086192 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:23.537032 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:40.676511 0.197070 tcp 10.0.2.16 49870 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:03:40.873421 0.253335 tcp 10.0.2.16 49871 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:03:41.127872 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:03:58.297160 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:17.256714 0.197526 tcp 10.0.2.16 49872 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:17.454787 0.205722 tcp 10.0.2.16 49873 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:17.661535 0.104634 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 392 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:17.766844 0.123193 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 732 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:17.767486 2.991391 tcp 10.0.2.16 49874 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:04:17.889253 0.269819 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 207 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:04:18.159811 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 278 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:26.767808 0.000000 tcp 10.0.2.16 49874 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:04:36.011324 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:38.775655 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 249 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:43.782500 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 273 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:48.790040 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 190 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:04:52.237312 0.173684 tcp 10.0.2.16 49875 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:04:52.411549 0.213837 tcp 10.0.2.16 49876 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:07:44.126176 3.000091 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:07:51.131367 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:07:59.133068 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:15.136551 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:47.142638 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:14:51.149709 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:14:58.156067 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:06.157499 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:22.159824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:54.166311 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:21:58.174099 2.999992 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:22:05.179392 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:13.181004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:29.184102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:23:01.190318 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:05.197394 3.000463 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:29:12.203387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:20.205099 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:36.208678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:30:08.213842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:35:22.086118 0.000145 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:35:22.086418 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:35:40.842919 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 163 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:35:57.541096 0.173631 tcp 10.0.2.16 49877 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:35:57.714981 0.216305 tcp 10.0.2.16 49878 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:35:57.932254 4.920296 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 479 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.031121 4.004323 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 1979 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.031766 2.999798 tcp 10.0.2.16 49879 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:35:58.147415 4.704724 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:35:58.417835 0.270467 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 546 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:02.948435 0.193682 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 1098 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:03.142532 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:07.030300 0.000000 tcp 10.0.2.16 49879 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 08:36:09.744295 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:12.221607 3.000559 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:36:15.241744 0.271712 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:18.516397 0.829493 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1140 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:19.037800 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:19.227755 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:19.346517 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:24.045100 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 159 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:27.228740 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:27.479619 0.277104 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 551 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:29.051592 2.338365 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 7 1568 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:30.754667 0.344929 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1684 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 08:36:31.390600 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:39.437037 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:43.232351 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:44.253257 0.000106 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:36:47.298434 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:36:54.458617 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:01.959444 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:09.520374 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:15.238116 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:37:17.561418 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:23.870653 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:28.757705 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:37:31.361427 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:36.809486 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:42.447654 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 150 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:37:48.315803 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 08:43:19.246049 3.000039 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:43:26.251371 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:34.252992 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:50.256174 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:44:22.262411 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:26.269943 2.999908 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:50:33.275243 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:41.276741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:57.280349 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:51:29.285786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:57:33.294181 2.999563 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:57:40.299616 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:57:48.301117 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:04.304119 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:36.310390 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:04:40.317394 2.999987 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:04:47.323178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:04:55.325106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:11.327809 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:43.334281 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:08:10.205548 0.000188 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:08:10.205900 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:25.357247 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:42.506369 0.172621 tcp 10.0.2.16 49880 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:08:42.679531 0.210988 tcp 10.0.2.16 49881 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:08:42.891723 0.282024 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 205 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:08:43.174410 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:08:43.175034 3.001442 tcp 10.0.2.16 49882 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:08:52.175597 0.000000 tcp 10.0.2.16 49882 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:08:58.555180 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:04.173134 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:09.180378 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 104 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:14.089537 0.172458 tcp 10.0.2.16 49883 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:14.187381 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:09:14.262317 0.205641 tcp 10.0.2.16 49884 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:14.469025 0.105087 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 388 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:09:14.574726 0.124129 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 769 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:11:47.341589 3.000062 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 09:11:54.347643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:02.348842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:18.352076 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:50.358027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:18:54.365524 3.000173 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:19:01.371079 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:09.372708 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:25.376109 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:57.382152 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:01.389566 3.000109 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:26:08.395193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:16.397298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:32.400102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:27:04.406268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:08.413866 2.999637 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:33:15.419684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:23.420967 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:39.423552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:34:11.430168 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:39:35.255959 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:39:35.256301 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 120 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:39:53.081638 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 208 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:11.682394 0.172582 tcp 10.0.2.16 49885 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:11.855468 0.205060 tcp 10.0.2.16 49886 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:12.061550 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:15.437462 2.999891 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 09:40:22.443387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:28.722629 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:30.445054 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:45.468673 0.183195 tcp 10.0.2.16 49887 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:45.652106 0.208950 tcp 10.0.2.16 49888 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:40:45.862040 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:40:46.447762 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:04.023507 0.270082 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 405 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.294277 0.111235 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 664 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.294866 3.002512 tcp 10.0.2.16 49889 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:41:04.404649 0.096278 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 225 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:04.501622 0.269201 rtcp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 573 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:07.768939 0.269878 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 563 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.043420 0.331703 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1481 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.374389 0.289717 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1207 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:11.664626 0.810776 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1299 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:12.475937 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:13.296501 0.000000 tcp 10.0.2.16 49889 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 09:41:18.453841 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:19.205429 0.281673 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 09:41:25.294046 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:30.250651 0.000106 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:41:30.301194 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 95 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:41:35.308816 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 09:47:22.461409 3.000161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:47:29.466942 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:37.468525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:53.472163 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:48:25.477637 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:54:29.485542 2.999579 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:54:36.491457 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:54:44.492387 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:00.495650 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:32.501869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:01:36.509357 3.000222 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:01:43.515362 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:01:51.516454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:07.519442 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:39.525642 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:08:43.533190 2.999976 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:08:50.538953 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:08:58.540831 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:14.543807 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:46.549640 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:11:22.628039 0.000124 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:11:22.628371 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:11:39.142103 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:11:54.959067 0.173404 tcp 10.0.2.16 49890 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:11:55.132979 0.213225 tcp 10.0.2.16 49891 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:11:55.347457 0.115302 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 519 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:11:55.462192 0.095052 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:11:55.463338 2.995721 tcp 10.0.2.16 49892 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:11:55.557682 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 133 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:04.467901 0.000000 tcp 10.0.2.16 49892 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:12:13.611516 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:16.475626 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:21.482824 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:26.489676 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:28.744995 0.187950 tcp 10.0.2.16 49893 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:12:28.933533 0.208766 tcp 10.0.2.16 49894 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:12:29.143449 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 INT 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:45.086549 0.273020 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 396 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:12:45.360257 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:12:45.360834 3.000361 tcp 10.0.2.16 49895 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:12:54.359551 0.000000 tcp 10.0.2.16 49895 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:13:01.680373 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:06.367093 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 236 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:11.253749 0.000172 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:13:11.374557 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:16.381798 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:13:18.077355 0.172596 tcp 10.0.2.16 49896 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:13:18.250515 0.202111 tcp 10.0.2.16 49897 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:15:50.557027 2.999938 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:15:57.562752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:05.564930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:21.567812 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:53.573869 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:22:57.581558 2.999750 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:23:04.586911 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:12.588486 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:28.591422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:24:00.597858 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:04.605004 3.000158 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:30:11.611191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:19.613012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:35.615435 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:31:07.621922 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:11.629418 2.999765 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:37:18.635048 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:26.636525 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:42.639558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:38:14.645432 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:43:24.271562 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:43:24.271884 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 238 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:43:42.467116 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:43:58.644848 0.183459 tcp 10.0.2.16 49898 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:43:58.828624 0.202749 tcp 10.0.2.16 49899 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:43:59.032411 4.979288 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 7 1294 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.144796 3.942892 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 8 1605 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.145891 2.999164 tcp 10.0.2.16 49900 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:43:59.256561 4.646191 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1611 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:43:59.529258 0.270434 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 443 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:04.121357 0.109842 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 5 1020 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:04.230356 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:08.143513 0.000000 tcp 10.0.2.16 49900 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:10.607507 0.000000 udp 10.0.2.16 15311 -> 66.235.190.17 14249 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:17.497415 0.000000 udp 10.0.2.16 15311 -> 66.36.228.41 13494 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:18.652807 3.000653 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:44:20.141107 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 232 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:22.664606 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:25.148691 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:25.658835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:30.025293 0.280071 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 589 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:30.155754 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:33.300668 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:33.660187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:39.809560 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:44.756687 0.000202 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:44:45.087132 0.272939 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 371 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.361938 0.346575 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1776 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.707989 0.286654 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1471 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:44:48.709023 3.007484 tcp 10.0.2.16 49901 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:48.995288 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:44:49.663220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:57.715195 0.000000 tcp 10.0.2.16 49901 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:44:57.885575 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:03.894098 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 168 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:09.712392 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:10.274086 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:14.719990 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:17.092857 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 200 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:19.726922 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:21.669308 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:45:24.704039 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:29.250171 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:45:31.984543 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:39.014915 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:45.053508 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:45:52.633818 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 202 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:00.284958 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 297 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:08.026015 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:12.752736 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:46:13.815032 0.813656 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1480 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 10:46:14.629517 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:14.630129 2.999978 tcp 10.0.2.16 49902 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:46:23.628838 0.000000 tcp 10.0.2.16 49902 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 10:46:35.636139 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:40.643383 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 175 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:46:45.650837 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 10:51:25.677045 3.000014 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:51:32.683142 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:40.684628 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:56.687183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:52:28.693646 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:58:32.701026 2.999745 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:58:39.707314 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:58:47.708404 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:03.711389 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:35.717280 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:05:39.724813 3.000136 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:05:46.730897 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:05:54.732178 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:10.735410 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:42.741365 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:12:46.749001 3.000166 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:12:53.754596 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:01.756102 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:17.759003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:49.765622 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:16:33.030577 0.000174 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:16:33.030898 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:16:51.646797 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 248 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:07.715090 0.173486 tcp 10.0.2.16 49903 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:07.888967 0.204859 tcp 10.0.2.16 49904 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:08.094882 0.112705 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 421 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:17:08.207169 0.096208 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 376 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:17:08.208206 3.006452 tcp 10.0.2.16 49905 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:17:08.303947 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:17.213671 0.000000 tcp 10.0.2.16 49905 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:17:23.993686 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:29.211741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:34.218697 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:39.225190 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:17:39.728804 0.174923 tcp 10.0.2.16 49906 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:39.904293 0.203429 tcp 10.0.2.16 49907 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:17:40.108707 0.266961 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 304 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:19:53.773257 2.999635 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 11:20:00.778820 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:08.780413 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:24.783528 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:56.789422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:00.796976 3.000488 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:27:07.802956 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:15.804580 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:31.807266 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:28:03.813607 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:07.819211 3.002058 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:34:14.827035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:22.828254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:38.831305 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:35:10.836983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:14.845185 2.999592 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:41:21.850391 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:29.852560 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:45.855510 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:42:17.861186 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:47:51.851793 0.000184 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:47:51.852157 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:09.827513 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:21.869239 3.000080 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:48:28.659589 0.176189 tcp 10.0.2.16 49908 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:48:28.836172 0.212541 tcp 10.0.2.16 49909 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:48:28.875012 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:29.049717 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:36.875808 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:44.787860 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:48:52.879098 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:00.051528 0.172861 tcp 10.0.2.16 49910 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:49:00.224796 0.203834 tcp 10.0.2.16 49911 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:49:00.429748 0.119710 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 644 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.548899 0.097003 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.549953 3.004791 tcp 10.0.2.16 49912 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:49:00.646494 0.272464 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 353 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:00.919751 0.277094 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 584 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:04.195904 0.280639 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 424 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:07.480524 0.290255 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1247 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:07.771477 0.825137 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1122 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:08.597244 0.356550 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1460 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:08.953141 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 310 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:09.552737 0.000000 tcp 10.0.2.16 49912 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 11:49:16.603679 0.272873 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 592 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 11:49:21.550698 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:24.885372 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:26.557904 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 118 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:49:31.564920 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 11:55:28.892632 3.000001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:55:35.898871 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:55:43.900421 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:55:59.903431 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:56:31.909284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:02:35.916933 2.999772 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:02:42.922914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:02:50.923824 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:06.927630 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:38.933234 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:09:42.940531 2.999993 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:09:49.946819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:09:57.948084 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:13.951112 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:45.957353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:16:49.963194 3.001605 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:16:56.970683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:04.972103 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:20.975340 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:52.980766 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:19:20.787927 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:19:20.788289 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:37.271384 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 151 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:55.892582 0.180889 tcp 10.0.2.16 49913 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:19:56.073956 0.210478 tcp 10.0.2.16 49914 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:19:56.285503 0.097321 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:19:56.383482 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:19:56.384042 2.998551 tcp 10.0.2.16 49915 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:05.381479 0.000000 tcp 10.0.2.16 49915 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:15.055595 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:17.378629 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:22.385778 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 258 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:27.393378 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 146 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:31.912101 0.178525 tcp 10.0.2.16 49916 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:20:32.085618 0.210591 tcp 10.0.2.16 49917 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:20:32.297274 0.118895 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 620 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:20:32.415700 0.268633 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 339 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:20:32.416744 2.998057 tcp 10.0.2.16 49918 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:32.684961 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:41.413109 0.000000 tcp 10.0.2.16 49918 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:20:50.666608 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 155 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:53.410445 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:20:58.417878 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 121 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:21:03.425003 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:21:08.625162 0.191585 tcp 10.0.2.16 49919 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:21:08.817160 0.211474 tcp 10.0.2.16 49920 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:23:56.988829 3.000241 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:24:03.994427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:11.995683 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:27.998793 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:25:00.005226 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:04.012877 3.000209 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:31:11.018512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:19.019937 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:35.023352 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:32:07.028648 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:11.036502 3.000268 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:38:18.042284 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:26.044006 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:42.046586 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:39:14.052957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:18.060056 3.000255 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:45:25.067183 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:33.068857 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:49.072342 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:46:21.076925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:51:20.888081 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:51:20.888374 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:51:38.973871 0.000000 udp 10.0.2.16 15311 -> 66.235.168.5 11159 REQ 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:51:55.572433 0.173259 tcp 10.0.2.16 49921 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:51:55.746158 0.218776 tcp 10.0.2.16 49922 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:51:55.965910 4.997838 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 5 944 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.071244 4.026043 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 12 2170 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.071846 3.000745 tcp 10.0.2.16 49923 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:51:56.193233 4.672612 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 8 1502 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:51:56.447697 0.262408 udp 10.0.2.16 15311 <-> 66.235.168.5 11159 CON 0 0 3 612 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:01.058639 0.095462 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 656 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:01.154631 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:05.071369 0.000000 tcp 10.0.2.16 49923 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:09.227998 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 165 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:17.070389 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:17.349025 0.247519 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 451 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:20.594198 0.752916 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1204 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:21.347798 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 REQ 0 1 161 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:22.076347 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 109 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:25.084401 2.999971 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:52:27.083017 4.950493 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 4 912 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:28.294959 0.258185 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 399 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:31.559767 0.377901 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1815 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:32.090242 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:32.129490 0.094242 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 3 660 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 12:52:32.224416 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:32.224998 2.999757 tcp 10.0.2.16 49924 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:38.699748 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:39.751035 0.000217 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:52:40.092159 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:41.223859 0.000000 tcp 10.0.2.16 49924 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 12:52:45.279824 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:53.221161 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:54.242478 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:52:56.094615 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:58.228225 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 262 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:00.952504 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 169 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:03.235161 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 267 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:08.723502 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 264 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:17.445986 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:22.252938 0.000107 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:53:23.564536 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 298 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:28.100786 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:53:29.592912 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:37.594732 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:45.876356 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:53:53.417523 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 12:59:32.108833 2.999678 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:59:39.113957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:59:47.115535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:03.119106 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:35.125213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:06:39.132565 3.000248 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:06:46.138427 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:06:54.139474 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:10.142670 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:42.148997 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:13:46.156923 2.999863 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:13:53.162520 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:01.164027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:17.166913 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:49.173077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:20:53.180215 3.000502 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:21:00.186537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:08.188042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:24.191127 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:56.196454 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:24:13.424676 0.000116 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:24:13.425016 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 153 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:31.740600 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:50.272671 0.178127 tcp 10.0.2.16 49925 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:24:50.444676 0.211882 tcp 10.0.2.16 49926 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:24:50.657524 0.168165 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 246 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:24:50.826238 0.110248 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:24:50.826700 2.995005 tcp 10.0.2.16 49927 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:24:50.935620 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 224 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:24:59.820703 0.000000 tcp 10.0.2.16 49927 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:08.242850 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:11.828240 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 92 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:16.835082 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:21.842323 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:26.680551 0.177336 tcp 10.0.2.16 49928 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:25:26.857791 0.207732 tcp 10.0.2.16 49929 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:25:27.066578 0.095679 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 296 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:25:27.163203 3.001343 tcp 10.0.2.16 49930 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:36.162798 0.000000 tcp 10.0.2.16 49930 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:25:48.160351 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:53.167364 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 198 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:25:58.174872 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:28:00.204330 2.999720 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:28:07.210498 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:15.211816 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:31.214360 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:29:03.220679 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:07.226675 3.002217 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:35:14.234264 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:22.235724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:38.239005 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:36:10.245008 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:14.252276 3.000422 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:42:21.258641 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:29.260132 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:45.262663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:43:17.269003 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:21.276221 3.000448 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:49:28.282255 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:36.283738 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:52.286663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:50:24.292535 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:55:33.848051 0.000138 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:55:33.848341 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:55:50.081652 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 257 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:06.249366 0.172513 tcp 10.0.2.16 49931 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:06.422186 0.205377 tcp 10.0.2.16 49932 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:06.628563 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 275 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:21.996743 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 114 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:28.300123 3.000757 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:56:35.306134 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:40.606136 0.179399 tcp 10.0.2.16 49933 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:40.780368 0.221657 tcp 10.0.2.16 49934 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:56:41.003047 0.174835 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 390 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.178536 0.114794 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 492 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.179111 2.999587 tcp 10.0.2.16 49935 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:56:41.292824 0.097039 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 311 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:41.390566 0.173395 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 601 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:43.307821 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:44.559939 0.171004 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:47.734462 0.343004 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1759 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.077014 0.289343 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1160 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.366871 0.513510 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1165 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:48.880943 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:56:50.187787 0.000000 tcp 10.0.2.16 49935 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 13:56:56.577207 0.179760 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 509 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:56:59.310412 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:56:59.761422 2.433519 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:00.277603 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 300 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:06.160375 0.169847 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 365 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:07.202151 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 283 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:09.325574 0.407557 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1388 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:09.732107 0.289727 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1264 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 13:57:10.022420 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 294 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:12.209501 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:15.634182 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 197 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:21.913573 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:26.750071 0.000127 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:57:28.082253 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:31.316254 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:57:35.803202 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 162 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:43.183843 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 246 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:48.811673 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:57:55.060951 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 214 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:00.488358 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 237 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:07.579035 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 314 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:12.255057 0.000283 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:58:16.571748 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 13:58:25.054439 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 299 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:03:35.324402 3.000001 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 14:03:42.330191 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:03:50.331415 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:06.334193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:38.340409 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:10:42.348145 2.999955 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:10:49.353819 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:10:57.355590 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:13.358149 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:45.365049 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:17:49.371968 3.000071 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:17:56.378213 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:04.379091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:20.382298 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:52.388503 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:24:56.396218 3.000184 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:25:03.402347 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:11.403433 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:27.406335 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:25:59.412439 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:28:58.950986 0.000131 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:28:58.951296 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:14.944231 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 229 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:32.914022 0.173672 tcp 10.0.2.16 49936 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:29:33.088065 0.224014 tcp 10.0.2.16 49937 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:29:33.313303 0.203282 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 338 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:29:33.517210 0.111407 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 685 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:29:33.517772 3.006861 tcp 10.0.2.16 49938 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 14:29:33.627801 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 105 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:42.522830 0.000000 tcp 10.0.2.16 49938 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 14:29:52.127670 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:54.520622 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:29:59.528106 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:30:04.535292 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 14:30:07.681431 0.172661 tcp 10.0.2.16 49939 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:30:07.854485 0.202705 tcp 10.0.2.16 49940 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:30:08.058234 0.096039 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 260 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 14:32:03.419825 3.000680 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 14:32:10.425491 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:32:18.427466 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:32:34.430225 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:33:06.436239 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:10.443843 3.000215 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:39:17.449448 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:25.451136 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:39:41.454345 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:40:13.460676 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:17.468002 3.000309 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:46:24.473537 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:32.475665 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:46:48.478437 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:47:20.484027 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:24.492193 3.000161 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:53:31.497653 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:39.499552 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:53:55.502231 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:54:27.508813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:31.515677 3.000545 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:00:36.088440 0.000187 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:00:36.088811 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:00:38.522077 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:46.523161 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:00:54.314189 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:02.526502 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:10.723123 0.172283 tcp 10.0.2.16 49941 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:10.895938 0.220865 tcp 10.0.2.16 49942 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:11.117784 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 152 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:28.613943 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:34.532701 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:44.518949 0.183239 tcp 10.0.2.16 49943 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:44.702683 0.202988 tcp 10.0.2.16 49944 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:01:44.906690 0.174772 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 303 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.082128 0.111270 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 635 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.082777 2.998587 tcp 10.0.2.16 49945 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:01:45.192905 0.096028 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 385 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:45.289701 0.174643 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 609 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:48.462811 0.173871 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 524 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:51.637085 0.331823 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1469 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:51.968265 0.285692 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1233 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:52.254485 0.515715 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1072 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:01:52.770859 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 274 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:01:54.080091 0.000000 tcp 10.0.2.16 49945 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:01:58.366821 0.174227 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 506 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:01.541581 4.546463 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1273 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:02.060625 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:08.841832 0.174609 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 450 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:11.095102 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 102 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:12.016384 0.341061 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1700 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:12.357003 0.297752 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1351 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:02:12.655441 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:16.102351 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:21.299519 0.353199 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:21.652718 0.000000 icmp 115.69.240.13 0x000b -> 10.0.2.16 0x0000 TXD 192 1 202 flow=Background 1970/01/04 15:02:26.246622 0.000103 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:02:29.421233 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:37.653170 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 247 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:43.531412 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:51.293006 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 139 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:02:57.901943 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 305 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:05.563509 0.959382 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 281 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:06.522891 0.000000 icmp 223.19.48.1 0x000b -> 10.0.2.16 0x0000 TXD 192 1 281 flow=Background 1970/01/04 15:03:10.249568 0.000126 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:03:11.141262 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:19.783664 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 255 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:26.333555 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 126 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:03:34.735690 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 191 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:07:38.539668 3.000229 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 15:07:45.545724 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:07:53.547721 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:09.550399 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:41.555903 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:14:45.563926 2.999705 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:14:52.569346 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:00.571485 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:16.573842 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:48.580574 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:21:52.588386 3.000038 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:21:59.593698 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:07.595091 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:23.598229 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:55.603813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:28:59.610647 3.001318 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:29:06.617657 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:29:14.618678 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:29:30.622197 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:30:02.628262 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:33:53.350497 0.000107 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:33:53.350679 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 286 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:11.095146 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 239 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:26.832925 0.173713 tcp 10.0.2.16 49946 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:34:27.007066 0.217276 tcp 10.0.2.16 49947 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:34:27.225339 0.174199 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 316 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.400047 0.115669 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.400414 3.002938 tcp 10.0.2.16 49948 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:34:27.514919 0.098125 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 357 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 15:34:27.613633 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 184 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:36.401998 0.000000 tcp 10.0.2.16 49948 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 15:34:46.476096 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 173 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:48.399975 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 270 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:53.406759 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 97 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:34:58.413263 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 204 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 15:35:02.842477 0.183533 tcp 10.0.2.16 49949 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:35:03.025924 0.208721 tcp 10.0.2.16 49950 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:36:06.635780 2.999863 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 15:36:13.641417 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:36:21.643035 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:36:37.646464 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:37:09.652055 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:13.659583 3.000609 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:43:20.665811 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:28.666705 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:43:44.670061 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:44:16.676092 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:20.683967 3.000020 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:50:27.689697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:35.690744 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:50:51.694193 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:51:23.699900 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:27.707207 3.000543 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:57:34.713353 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:42.715089 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:57:58.717752 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:58:30.724271 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:04:34.731729 2.999753 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:04:41.737118 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:04:49.739220 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:05.742195 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:11.620723 0.000128 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:05:11.621012 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:05:28.485144 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:05:37.747919 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:45.803793 0.176166 tcp 10.0.2.16 49951 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:05:45.980440 0.203147 tcp 10.0.2.16 49952 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:05:46.184575 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 287 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:03.294733 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:22.053540 0.172980 tcp 10.0.2.16 49953 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:06:22.226999 0.199766 tcp 10.0.2.16 49954 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:06:22.427781 0.115985 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 593 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.543145 0.169975 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 342 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.544311 3.002493 tcp 10.0.2.16 49955 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:06:22.713506 0.095616 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 368 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:22.809623 0.177182 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 466 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:25.987620 0.171040 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 626 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.162085 0.511484 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1322 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.674169 0.285610 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1298 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:29.960346 0.341330 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1402 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:30.300836 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:31.544993 0.000000 tcp 10.0.2.16 49955 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:06:38.145211 0.170477 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 632 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:41.319588 0.520040 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1291 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:41.840198 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:43.542635 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:48.319513 0.172866 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 638 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:48.550064 3.293713 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 9 1657 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:51.843026 0.286035 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:06:52.129646 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:53.556741 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 125 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:06:57.582823 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:03.611325 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 140 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:08.248442 0.000142 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:07:09.710384 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:16.209427 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 188 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:24.512064 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 280 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:32.343216 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 174 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:38.281111 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 228 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:44.400553 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 301 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:52.982863 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:07:57.749013 0.000170 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:07:58.991478 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:08:06.621858 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 156 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:11:41.755749 2.999490 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 16:11:48.761436 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:11:56.762564 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:12.766268 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:44.771662 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:18:48.779120 3.000647 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:18:55.785401 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:03.787131 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:19.790043 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:51.795914 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:25:55.803733 2.999815 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:26:02.809205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:10.810993 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:26.813727 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:26:58.819764 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:02.827773 2.999429 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:33:09.833190 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:17.834472 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:33:33.838090 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:34:05.843733 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:38:21.131613 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:38:21.131941 0.374083 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 262 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:38:21.506753 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 176 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:21.507618 2.998337 tcp 10.0.2.16 49956 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:38:30.503961 0.000000 tcp 10.0.2.16 49956 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:38:37.264737 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:42.501569 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 138 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:47.508653 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:52.516101 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 167 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:54.393781 1.822392 tcp 10.0.2.16 49957 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:38:56.215855 1.471131 tcp 10.0.2.16 49958 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:38:57.688136 0.870147 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 629 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:38:58.558664 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 193 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:38:58.559292 2.999528 tcp 10.0.2.16 49959 -> 194.94.127.98 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:07.567420 0.000000 tcp 10.0.2.16 49959 -> 194.94.127.98 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:17.552217 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 123 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:19.565057 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 226 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:24.572201 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 210 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:29.579549 0.000000 udp 10.0.2.16 15311 -> 194.94.127.98 25549 REQ 0 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:39:36.081218 1.916344 tcp 10.0.2.16 49960 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:39:37.998108 1.618626 tcp 10.0.2.16 49961 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:39:39.617802 0.636148 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 315 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 16:39:40.255190 2.993458 tcp 10.0.2.16 49962 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:39:49.257835 0.000000 tcp 10.0.2.16 49962 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 16:40:01.255387 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:06.262476 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:09.851437 3.000281 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 16:40:11.269806 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 101 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 16:40:16.857063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:40:24.858961 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:40:40.861904 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:41:12.868313 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:16.875578 2.999492 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:47:23.881424 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:31.882559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:47:47.886070 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:48:19.891478 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:23.899545 2.999768 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:54:30.905384 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:38.906962 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:54:54.909925 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:55:26.915745 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:01:30.923484 3.000220 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:01:37.928773 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:01:45.931063 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:01.933324 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:33.939660 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:08:37.946933 3.000880 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:08:44.953286 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:08:52.954273 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:08.957957 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:40.963635 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:10:09.385041 0.000086 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:10:09.385221 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 218 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:26.689787 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 290 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:42.276585 0.174226 tcp 10.0.2.16 49963 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:10:42.451306 0.218909 tcp 10.0.2.16 49964 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:10:42.671297 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 271 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:10:58.585836 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:16.944289 0.173414 tcp 10.0.2.16 49965 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:11:17.118251 0.205283 tcp 10.0.2.16 49966 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:11:17.324582 0.168012 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 302 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.493210 0.123198 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 619 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.493791 3.002762 tcp 10.0.2.16 49967 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:11:17.615920 0.095037 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 228 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:17.711490 0.179874 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 465 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:20.887406 0.173219 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 679 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.062856 0.377275 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1689 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.439297 0.285383 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1305 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:24.725229 0.506653 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1297 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:25.232479 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 253 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:26.495535 0.000000 tcp 10.0.2.16 49967 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:11:34.226398 0.179578 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 582 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:37.401662 1.091085 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:37.907529 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:43.500130 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 284 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:46.143785 0.172887 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 685 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:48.507093 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 203 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:49.318851 0.373497 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1683 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:49.691733 0.284936 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1253 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:11:49.977105 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 213 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:55.236610 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 177 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:11:59.753533 0.000168 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:12:03.839512 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 181 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:10.849292 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 303 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:19.591944 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 148 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:27.052879 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 260 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:34.082652 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:42.725110 0.401068 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 135 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:43.126178 0.000000 icmp 113.252.247.200 0x0303 -> 10.0.2.16 0x612b URP 192 1 135 flow=Background 1970/01/04 17:12:47.251060 0.000109 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:12:49.855144 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 241 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:12:57.126058 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 235 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:13:05.468007 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:13:13.469431 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 196 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:15:44.971761 2.999714 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:15:51.977205 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:15:59.978199 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:15.981548 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:47.987319 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:22:51.995524 2.999417 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:22:59.000684 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:07.002672 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:23.005735 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:55.011515 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:29:59.019516 2.999940 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:30:06.025164 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:30:14.026611 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:30:30.030086 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:31:02.035185 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:06.043711 2.999716 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:37:13.049512 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:21.050436 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:37:37.053579 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:38:09.059295 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:43:23.412246 0.000143 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:43:23.412545 0.176520 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 297 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:23.589805 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:23.590546 3.005361 tcp 10.0.2.16 49968 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:43:32.595039 0.000000 tcp 10.0.2.16 49968 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 17:43:41.798415 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 243 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:44.591948 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 187 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:49.598969 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 259 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:54.606437 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 209 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:43:58.566394 0.183429 tcp 10.0.2.16 49969 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:43:58.750378 0.203666 tcp 10.0.2.16 49970 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:43:58.955070 0.137747 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 518 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:59.092321 0.095232 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 355 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 17:43:59.188054 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:44:13.067708 3.000391 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:44:15.396045 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 234 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 17:44:20.072557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:44:28.074423 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:44:32.422121 0.172959 tcp 10.0.2.16 49971 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:44:32.595604 0.214214 tcp 10.0.2.16 49972 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:44:44.077612 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:45:16.083446 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:20.090618 3.000851 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:51:27.096557 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:35.098663 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:51:51.101627 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:52:23.107518 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:27.115225 3.000337 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:58:34.120813 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:42.122177 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:58:58.125339 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:30.131643 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:05:34.139440 2.999942 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:05:41.144932 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:05:49.145968 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:06:05.149230 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:06:37.155440 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:12:41.162727 3.000707 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:12:48.168558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:12:56.169983 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:12.173488 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:44.179004 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:15:01.350558 0.000192 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:15:01.350924 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:17.043230 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 292 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:33.201062 0.172504 tcp 10.0.2.16 49973 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:15:33.373966 0.208553 tcp 10.0.2.16 49974 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:15:33.583076 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 215 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:15:52.233788 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 98 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:08.689145 0.173873 tcp 10.0.2.16 49975 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:16:08.863498 0.227367 tcp 10.0.2.16 49976 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:16:09.091965 0.178007 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 381 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.270698 0.123372 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 514 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.271310 3.000584 tcp 10.0.2.16 49977 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:16:09.392791 0.097561 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 307 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:09.491043 0.171231 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 531 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:12.663353 0.168460 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 641 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:15.827217 0.366156 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1633 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:16.193050 0.302232 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1257 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:16.495837 0.510203 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1269 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:17.006615 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 160 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:18.270545 0.000000 tcp 10.0.2.16 49977 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:16:24.469708 0.186479 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 495 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:27.654715 2.614521 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1362 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:28.165229 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 285 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:34.203869 0.169174 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 558 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:35.275279 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:37.368355 0.367022 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1647 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:37.734833 0.288782 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1366 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:16:38.024167 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 144 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:40.282840 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 178 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:43.176874 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:49.325940 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 231 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:16:54.252201 0.000169 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:16:55.885066 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:02.905527 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:08.733818 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 288 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:17.345915 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 291 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:22.953811 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 269 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:28.291751 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 240 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:35.151765 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 116 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:39.748383 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:17:43.143135 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 230 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:17:50.052793 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 242 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:19:48.186874 2.999839 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 18:19:55.192796 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:03.193952 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:19.197685 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:51.203042 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:26:55.210666 2.999985 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:27:02.216619 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:10.218129 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:26.220883 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:58.227521 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:02.232450 3.002243 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:34:09.240330 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:17.242430 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:34:33.245095 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:35:05.251143 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:09.258504 3.000444 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:41:16.264909 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:24.266782 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:41:40.268835 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:42:12.275263 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:02.078570 0.000149 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:48:02.078883 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 127 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:16.283497 2.999728 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:48:19.633246 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:23.288581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:31.290060 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:34.780112 0.172815 tcp 10.0.2.16 49978 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:48:34.953459 0.206139 tcp 10.0.2.16 49979 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:48:35.160603 0.173337 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 321 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:48:35.334450 0.111062 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 588 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:48:35.334811 2.995510 tcp 10.0.2.16 49980 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:48:35.445053 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 131 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:44.328760 0.000000 tcp 10.0.2.16 49980 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 18:48:47.292805 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:48:52.430369 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 220 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:48:56.336096 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 179 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:01.343510 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 143 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:06.351004 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 18:49:10.499006 0.193736 tcp 10.0.2.16 49981 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:49:10.693190 0.205918 tcp 10.0.2.16 49982 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:49:10.900289 0.099184 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 389 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 18:49:19.299558 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:23.306918 2.999837 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:55:30.312222 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:38.314074 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:55:54.317187 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:56:26.323419 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:02:30.331359 2.999783 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:02:37.337064 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:02:45.338158 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:01.341422 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:33.346760 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:09:37.354806 2.999597 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:09:44.360830 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:09:52.362065 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:08.365275 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:40.371046 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:16:44.378623 2.999919 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:16:51.384697 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:16:59.385890 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:15.389300 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:47.395592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:19:31.635603 0.000181 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:19:31.635972 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:19:48.459939 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 216 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:04.937617 0.324262 tcp 10.0.2.16 49983 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:05.262252 0.214039 tcp 10.0.2.16 49984 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:05.477290 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 185 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:23.669836 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 182 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:41.697833 0.173096 tcp 10.0.2.16 49985 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:41.871383 0.215455 tcp 10.0.2.16 49986 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:20:42.087962 0.173773 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 261 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.262356 0.117753 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 762 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.262946 2.988052 tcp 10.0.2.16 49987 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:20:42.379278 0.096677 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 391 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:42.476691 0.170996 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 525 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:45.651746 0.174948 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 664 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:48.826445 0.357323 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1413 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.183031 0.285567 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1276 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.469205 0.526418 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 6 1020 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:20:49.996093 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 119 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:20:51.249670 0.000000 tcp 10.0.2.16 49987 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:20:58.099186 0.170316 udp 10.0.2.16 15311 <-> 66.235.184.138 15081 CON 0 0 3 497 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:01.274189 1.983048 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 7 1284 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:01.794876 0.000000 udp 10.0.2.16 15311 -> 66.148.80.28 24833 INT 0 1 189 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:08.264314 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 277 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:08.754556 0.174751 udp 10.0.2.16 15311 <-> 66.36.230.86 19347 CON 0 0 3 527 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:11.928843 0.349698 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 8 1657 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:12.277732 0.295395 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 6 1329 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:21:12.573748 0.000000 udp 10.0.2.16 15311 -> 111.240.194.123 10188 INT 0 1 129 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:13.271429 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 115 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:21.142425 0.000000 udp 10.0.2.16 15311 -> 115.69.241.182 21008 INT 0 1 295 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:25.748871 0.000142 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:21:28.262884 0.000000 udp 10.0.2.16 15311 -> 111.242.171.190 16584 INT 0 1 233 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:36.915372 0.000000 udp 10.0.2.16 15311 -> 178.91.32.168 16355 INT 0 1 124 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:42.493130 0.000000 udp 10.0.2.16 15311 -> 88.87.244.16 19811 INT 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:48.772216 0.000000 udp 10.0.2.16 15311 -> 123.240.194.78 21477 INT 0 1 219 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:21:57.585312 0.000000 udp 10.0.2.16 15311 -> 84.2.155.234 15326 INT 0 1 166 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:04.344799 0.000000 udp 10.0.2.16 15311 -> 113.252.247.200 11105 INT 0 1 254 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:09.251380 0.000167 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:22:13.227851 0.000000 udp 10.0.2.16 15311 -> 89.41.100.12 18279 INT 0 1 142 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:20.457347 0.000000 udp 10.0.2.16 15311 -> 187.19.218.40 26151 INT 0 1 134 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:25.845598 0.000000 udp 10.0.2.16 15311 -> 95.57.211.247 20586 INT 0 1 207 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:22:33.446180 0.000000 udp 10.0.2.16 15311 -> 62.5.128.33 24761 INT 0 1 227 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:23:51.402386 3.000729 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 19:23:58.408400 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:06.410169 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:22.412770 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:54.419354 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:30:58.424725 3.001975 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:31:05.433130 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:31:13.433930 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:31:29.437270 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:32:01.443069 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:05.450061 3.000436 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:38:12.456252 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:20.457581 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:38:36.461151 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:39:08.466860 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:12.475057 2.999635 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:45:19.480304 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:27.481592 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:45:43.485108 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:46:15.490955 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:19.498818 1.237537 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/04 19:52:26.104580 4.224963 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/04 19:52:38.331398 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:57.538589 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:52:59.722180 0.000171 arp 10.0.2.16 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:52:59.722515 0.171739 udp 10.0.2.16 15311 <-> 66.148.64.18 24305 CON 0 0 2 241 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:52:59.895020 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 INT 0 1 261 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:52:59.895987 3.000549 tcp 10.0.2.16 49988 -> 66.148.64.18 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:53:08.895952 0.000000 tcp 10.0.2.16 49988 -> 66.148.64.18 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:53:15.835469 0.000000 udp 10.0.2.16 15311 -> 66.235.184.138 15081 REQ 0 1 113 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:20.893378 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 211 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:25.900048 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 244 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:29.544843 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:53:30.907343 0.000000 udp 10.0.2.16 15311 -> 66.148.64.18 24305 REQ 0 0 1 149 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:32.864879 0.174096 tcp 10.0.2.16 49989 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:53:33.039682 0.219110 tcp 10.0.2.16 49990 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:53:33.259799 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 INT 0 1 222 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:53:52.127382 0.000000 udp 10.0.2.16 15311 -> 66.36.230.86 19347 REQ 0 1 192 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:07.181403 0.173070 tcp 10.0.2.16 49991 -> 173.194.70.106 80 FSPA* 0 0 10 1818 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:54:07.354823 0.207507 tcp 10.0.2.16 49992 -> 173.194.70.94 80 SRPA* 0 0 7 1994 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:54:07.563554 0.098304 udp 10.0.2.16 15311 <-> 195.169.125.228 29902 CON 0 0 2 214 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:54:07.662516 0.122148 udp 10.0.2.16 15311 <-> 194.94.127.98 25549 CON 0 0 4 494 flow=From-Botnet-V1-UDP-Establishedd 1970/01/04 19:54:07.663079 3.001160 tcp 10.0.2.16 49993 -> 195.169.125.228 13606 S_ 0 2 132 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:54:16.662302 0.000000 tcp 10.0.2.16 49993 -> 195.169.125.228 13606 S_ 0 1 62 flow=From-Botnet-V1-TCP-Attempt 1970/01/04 19:54:28.660394 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 195 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:33.667217 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 183 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:54:38.674707 0.000000 udp 10.0.2.16 15311 -> 195.169.125.228 29902 REQ 0 0 1 136 flow=From-Botnet-V1-UDP-Attempt 1970/01/04 19:59:33.550841 3.001887 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 19:59:40.558218 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:59:48.559529 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:04.563559 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:36.569024 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:06:40.576526 3.000314 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:06:47.582011 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:06:55.583803 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:07:11.587189 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:07:43.593010 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:13:47.600748 2.999678 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:13:54.606385 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:02.607674 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:18.610741 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:50.616563 0.000000 udp fe80::6dd3:1409:3456:8562 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background