StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:07.183465 3.004606 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 01:00:07.243655 2.003163 arp 0.0.0.0 who 10.0.2.112 INT 3 126 flow=Background-ARP 1970/01/01 01:00:07.243745 0.000000 ipv6-icmp :: 135 -> ff02::1:ffb5:ff61 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:07.243782 4.006119 ipv6-icmp fe80::1daf:d1a3:4b5:ff61 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:07.243841 0.500832 ipv6-icmp fe80::1daf:d1a3:4b5:ff61 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:07.394424 2.856689 arp 10.0.2.112 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:09.084144 0.000000 udp 10.0.2.112 58711 -> 8.8.8.8 53 INT 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:00:09.101767 0.000136 arp 10.0.2.2 who 10.0.2.112 CON 2 84 flow=Background-ARP 1970/01/01 01:00:10.077572 0.017492 udp 10.0.2.112 58711 <-> 8.8.4.4 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/01 01:00:10.095492 0.028676 udp 10.0.2.112 58033 <-> 8.8.4.4 53 CON 0 0 4 360 flow=From-Botnet-V2-DNS 1970/01/01 01:00:10.124168 0.000000 icmp 10.0.2.112 0x0303 -> 8.8.4.4 0xb1e2 URP 0 1 132 flow=Background 1970/01/01 01:00:14.193494 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:00:15.245168 0.000000 ipv6-icmp fe80::1daf:d1a3:4b5:ff61 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:22.195195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:00:38.198521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:01:03.968603 0.017972 udp 10.0.2.112 54299 <-> 8.8.8.8 53 CON 0 0 2 380 flow=From-Botnet-V2-DNS 1970/01/01 01:01:03.989486 0.118101 tcp 10.0.2.112 49158 -> 195.113.214.215 80 FSPA* 0 0 10 1026 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:04.116685 0.017566 udp 10.0.2.112 60989 <-> 8.8.8.8 53 CON 0 0 2 204 flow=From-Botnet-V2-DNS 1970/01/01 01:01:04.134681 0.117843 tcp 10.0.2.112 49159 -> 37.19.5.49 80 FSPA* 0 0 10 1599 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:04.811948 0.094758 udp fe80::1daf:d1a3:4b5:ff61 51440 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:01:04.812155 0.094709 udp 10.0.2.112 58233 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:01:04.812242 0.094622 icmp 10.0.2.2 0x000b -> 10.0.2.112 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:01:05.106851 1.502773 udp 10.0.2.112 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:01:05.106942 1.502682 icmp 10.0.2.2 0x0003 -> 10.0.2.112 0x0a00 URN 192 3 360 flow=Background 1970/01/01 01:01:07.501376 0.019774 udp 10.0.2.112 51717 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V2-DNS 1970/01/01 01:01:07.521649 0.498857 tcp 10.0.2.112 49160 -> 216.8.179.23 80 SRPA* 0 0 9 3377 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:10.193328 0.019324 udp 10.0.2.112 62510 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:10.213092 0.114673 tcp 10.0.2.112 49161 -> 37.19.5.66 80 FSPA* 0 0 10 970 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:10.490562 0.020493 udp 10.0.2.112 55513 <-> 8.8.8.8 53 CON 0 0 2 204 flow=From-Botnet-V2-DNS 1970/01/01 01:01:10.511455 0.118241 tcp 10.0.2.112 49162 -> 37.19.5.49 80 FSPA* 0 0 11 2294 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:10.525049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:01:10.668088 0.401476 tcp 10.0.2.112 49163 -> 216.8.179.23 80 SRPA* 0 0 10 4836 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:10.669256 0.017408 udp 10.0.2.112 53989 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:10.695954 0.270379 tcp 10.0.2.112 49164 -> 37.19.5.66 80 SRPA* 0 0 55 52337 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:10.982275 0.017381 udp 10.0.2.112 50128 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:11.000055 1.386107 tcp 10.0.2.112 49165 -> 37.19.5.66 80 FSPA* 0 0 1008 1103493 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:11.070993 0.017529 udp 10.0.2.112 57048 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V2-DNS 1970/01/01 01:01:11.092380 1.414927 tcp 10.0.2.112 49166 -> 216.8.179.23 80 SPA_* 0 0 19 13354 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:12.396929 0.017777 udp 10.0.2.112 61317 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:12.415134 1.515648 tcp 10.0.2.112 49167 -> 37.19.5.66 80 FSPA* 0 0 964 1101129 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:13.941079 0.017809 udp 10.0.2.112 52009 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:13.959281 1.687962 tcp 10.0.2.112 49168 -> 37.19.5.66 80 FSPA* 0 0 1006 1103397 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:15.675829 0.017947 udp 10.0.2.112 64056 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:15.700295 1.253267 tcp 10.0.2.112 49169 -> 37.19.5.66 80 FSPA* 0 0 994 1102749 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:16.956274 0.017964 udp 10.0.2.112 64356 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:17.056403 1.575369 tcp 10.0.2.112 49170 -> 37.19.5.66 80 FSPA* 0 0 980 1101993 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:18.640165 0.017491 udp 10.0.2.112 51811 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:18.657992 1.618847 tcp 10.0.2.112 49171 -> 37.19.5.66 80 FSPA* 0 0 1005 1103343 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:20.280895 0.019908 udp 10.0.2.112 54485 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:20.301286 1.544171 tcp 10.0.2.112 49172 -> 37.19.5.66 80 FSPA* 0 0 977 1101831 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:20.959322 0.017561 udp 10.0.2.112 52711 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V2-DNS 1970/01/01 01:01:20.977435 2.505184 tcp 10.0.2.112 49173 -> 216.8.179.23 80 SPA_* 0 0 42 36370 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.606567 4.722116 tcp 10.0.2.112 49174 -> 216.8.179.23 80 SRPA* 0 0 17 6990 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.609755 4.718817 tcp 10.0.2.112 49175 -> 216.8.179.23 80 SRPA* 0 0 37 32419 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.610153 4.718771 tcp 10.0.2.112 49176 -> 216.8.179.23 80 SRPA* 0 0 34 26215 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.638500 0.019928 udp 10.0.2.112 55105 <-> 8.8.8.8 53 CON 0 0 2 388 flow=From-Botnet-V2-DNS 1970/01/01 01:01:21.638863 0.018579 udp 10.0.2.112 49426 <-> 8.8.8.8 53 CON 0 0 2 263 flow=From-Botnet-V2-DNS 1970/01/01 01:01:21.657848 0.111630 tcp 10.0.2.112 49177 -> 195.27.154.118 80 SPA_* 0 0 16 10257 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.658766 1.042437 tcp 10.0.2.112 49178 -> 195.113.214.211 80 SPA_* 0 0 53 47971 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:21.852725 0.018230 udp 10.0.2.112 63379 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V2-DNS 1970/01/01 01:01:21.871275 1.050334 tcp 10.0.2.112 49179 -> 37.19.5.66 80 FSPA* 0 0 528 587856 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:22.201336 4.127471 tcp 10.0.2.112 49180 -> 216.8.179.23 80 SRPA* 0 0 11 2935 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.017436 0.017166 udp 10.0.2.112 57223 <-> 8.8.8.8 53 CON 0 0 2 166 flow=From-Botnet-V2-DNS 1970/01/01 01:01:23.035149 2.029852 tcp 10.0.2.112 49181 -> 173.194.35.79 80 SPA_* 0 0 8 1602 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.403593 0.018298 udp 10.0.2.112 49835 <-> 8.8.8.8 53 CON 0 0 2 231 flow=From-Botnet-V2-DNS 1970/01/01 01:01:23.422336 1.642636 tcp 10.0.2.112 49182 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.422543 1.642400 tcp 10.0.2.112 49183 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.422742 1.642136 tcp 10.0.2.112 49184 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.423147 0.290916 tcp 10.0.2.112 49185 -> 173.194.44.250 80 SPA_* 0 0 11 6867 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.819612 0.017447 udp 10.0.2.112 61160 <-> 8.8.8.8 53 CON 0 0 2 198 flow=From-Botnet-V2-DNS 1970/01/01 01:01:23.838039 2.457368 tcp 10.0.2.112 49186 -> 144.76.1.130 80 FSPA* 0 0 12 2379 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:23.917763 0.017461 udp 10.0.2.112 50187 <-> 8.8.8.8 53 CON 0 0 2 266 flow=From-Botnet-V2-DNS 1970/01/01 01:01:23.935921 1.629872 tcp 10.0.2.112 49187 -> 173.194.44.250 80 SPA_* 0 0 8 2727 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:26.295626 2.314638 tcp 10.0.2.112 49188 -> 144.76.1.130 80 SPA_* 0 0 13 2429 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:26.329040 0.000000 tcp 10.0.2.112 49173 -> 216.8.179.23 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:31.610199 0.000000 tcp 10.0.2.112 49188 -> 144.76.1.130 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:40.045970 0.017554 udp 10.0.2.112 53711 <-> 8.8.8.8 53 CON 0 0 2 182 flow=From-Botnet-V2-DNS 1970/01/01 01:01:40.082943 0.139847 tcp 10.0.2.112 49189 -> 37.19.5.19 80 FSPA* 0 0 10 824 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:40.384389 0.000000 tcp 10.0.2.112 49166 -> 216.8.179.23 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:42.808358 0.017282 udp 10.0.2.112 50476 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 01:01:42.826158 0.147464 tcp 10.0.2.112 49190 -> 37.19.5.19 80 FSPA* 0 0 10 918 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:42.990789 0.019599 udp 10.0.2.112 49523 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 01:01:43.010961 0.108828 tcp 10.0.2.112 49191 -> 37.19.5.78 80 FSPA* 0 0 10 1134 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:43.729345 0.017804 udp 10.0.2.112 53128 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/01 01:01:43.747745 0.106035 tcp 10.0.2.112 49192 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.129109 0.019324 udp 10.0.2.112 63793 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V2-DNS 1970/01/01 01:01:44.148864 0.118627 tcp 10.0.2.112 49193 -> 37.19.5.78 80 FSPA* 0 0 15 7528 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.268980 0.108779 tcp 10.0.2.112 49194 -> 37.19.5.78 80 FSPA* 0 0 12 4511 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.394118 0.177791 tcp 10.0.2.112 49195 -> 37.19.5.78 80 FSPA* 0 0 30 20876 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.572434 0.173153 tcp 10.0.2.112 49196 -> 37.19.5.78 80 FSPA* 0 0 31 25625 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.693947 0.018188 udp 10.0.2.112 50547 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/01 01:01:44.695860 0.017290 udp 10.0.2.112 58613 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/01 01:01:44.700715 0.120081 tcp 10.0.2.112 49197 -> 37.19.5.78 80 FSPA* 0 0 10 1135 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.712569 0.113952 tcp 10.0.2.112 49198 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.713472 2.269173 tcp 10.0.2.112 49199 -> 37.19.5.22 80 SPA_* 0 0 110 89890 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.746443 0.159740 tcp 10.0.2.112 49200 -> 37.19.5.78 80 FSPA* 0 0 26 16779 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.836526 0.114560 tcp 10.0.2.112 49201 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:44.906671 0.140600 tcp 10.0.2.112 49202 -> 37.19.5.78 80 FSPA* 0 0 19 12326 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.047683 0.217026 tcp 10.0.2.112 49203 -> 37.19.5.78 80 FSPA* 0 0 17 10253 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.265157 0.118672 tcp 10.0.2.112 49204 -> 37.19.5.78 80 FSPA* 0 0 18 11857 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.384580 0.107795 tcp 10.0.2.112 49205 -> 37.19.5.78 80 FSPA* 0 0 12 4175 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.493057 0.172838 tcp 10.0.2.112 49206 -> 37.19.5.78 80 FSPA* 0 0 27 19812 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.666411 0.176717 tcp 10.0.2.112 49207 -> 37.19.5.78 80 FSPA* 0 0 26 17101 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.843782 0.117054 tcp 10.0.2.112 49208 -> 37.19.5.78 80 FSPA* 0 0 20 12977 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:45.961389 0.176688 tcp 10.0.2.112 49209 -> 37.19.5.78 80 FSPA* 0 0 26 17348 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:46.138728 0.107219 tcp 10.0.2.112 49210 -> 37.19.5.78 80 FSPA* 0 0 17 9875 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:46.364631 0.117534 tcp 10.0.2.112 49211 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:48.788116 0.107198 tcp 10.0.2.112 49212 -> 37.19.5.78 80 FSPA* 0 0 11 3098 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:48.896616 0.118329 tcp 10.0.2.112 49213 -> 37.19.5.78 80 FSPA* 0 0 11 3367 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:50.367651 0.017481 udp 10.0.2.112 64976 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V2-DNS 1970/01/01 01:01:50.369089 0.017407 udp 10.0.2.112 60400 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V2-DNS 1970/01/01 01:01:50.386381 0.169126 tcp 10.0.2.112 49214 -> 37.19.5.78 80 FSPA* 0 0 10 1149 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:50.386834 0.157310 tcp 10.0.2.112 49215 -> 37.19.5.78 80 FSPA* 0 0 10 1302 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:50.556866 0.017883 udp 10.0.2.112 57403 <-> 8.8.8.8 53 CON 0 0 2 194 flow=From-Botnet-V2-DNS 1970/01/01 01:01:50.575302 0.365390 tcp 10.0.2.112 49216 -> 38.102.136.141 80 FSPA* 0 0 10 1094 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:50.959708 0.017903 udp 10.0.2.112 53083 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 01:01:50.960600 0.018471 udp 10.0.2.112 55924 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 01:01:50.978117 0.115983 tcp 10.0.2.112 49217 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:01:50.979436 0.214798 tcp 10.0.2.112 49218 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:15.504330 0.000141 tcp 10.0.2.112 49199 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:20.100217 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:02:22.697626 4.023126 tcp 10.0.2.112 49178 -> 195.113.214.211 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.074435 3.646088 tcp 10.0.2.112 49181 -> 173.194.35.79 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.426404 3.293894 tcp 10.0.2.112 49183 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.427969 3.292232 tcp 10.0.2.112 49184 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.429135 3.290960 tcp 10.0.2.112 49182 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.713422 3.006976 tcp 10.0.2.112 49185 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:23.941549 2.778327 tcp 10.0.2.112 49187 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:02:26.720635 0.000000 tcp 10.0.2.112 49177 -> 195.27.154.118 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:43.777509 0.000087 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:06:43.777689 0.131860 tcp 10.0.2.112 49219 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:07:14.604212 3.004073 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 01:07:21.613712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:29.615339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:45.617973 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:08:17.624199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:14:21.744008 2.998503 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:14:28.747890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:14:36.749618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:14:52.782408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:15:24.788571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:21:28.975310 3.001173 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:21:35.982185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:21:43.983892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:21:59.996586 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:22:32.002641 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:28:36.008732 3.001621 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:28:43.016066 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:28:51.017495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:29:07.021357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:29:39.027048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:31:45.552010 0.000064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:31:45.552147 0.114672 tcp 10.0.2.112 49220 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:31:45.704443 0.000057 tcp 10.0.2.112 49199 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 01:31:46.344357 0.115104 tcp 10.0.2.112 49221 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:35:43.032704 3.001817 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:35:50.040317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:35:58.043847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:36:14.044458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:36:46.051341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:42:50.057735 3.000663 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:42:57.063706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:05.065677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:21.088705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:53.094492 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:49:57.101254 3.000737 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:50:04.108061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:50:12.109628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:50:28.112572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:51:00.118322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:04.125595 3.001437 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:57:11.132096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:19.133163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:35.136621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:58:07.142664 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:01:44.897423 0.000072 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:01:44.897696 0.108191 tcp 10.0.2.112 49222 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:01:45.029441 0.114468 tcp 10.0.2.112 49223 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:04:11.149708 3.020198 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:04:18.175870 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:04:26.177626 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:04:42.180571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:05:14.186299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:11:18.192280 3.002360 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:11:25.200294 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:11:33.201370 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:11:49.204375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:12:21.210317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:25.216537 3.001881 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:18:32.224033 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:40.225269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:56.228108 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:19:28.234674 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:25:32.240395 3.001662 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:25:39.247654 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:25:47.249690 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:26:03.252273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:26:35.258704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:31:44.905833 0.000123 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:31:44.906043 0.106166 tcp 10.0.2.112 49224 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:31:45.035653 0.114941 tcp 10.0.2.112 49225 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:32:39.265841 3.000778 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:32:46.271632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:32:54.313281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:33:10.356501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:33:42.382205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:39:46.388384 3.001682 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:39:53.396189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:01.407570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:17.410736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:49.416703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:46:53.422221 3.002243 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:47:00.429719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:08.431798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:24.434837 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:56.440349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:00.446322 3.001753 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:54:07.454208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:15.455340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:31.458337 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:55:03.464432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:07.471141 3.001102 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:01:14.478381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:22.479096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:38.482408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:45.014291 0.000117 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:01:45.014517 0.106009 tcp 10.0.2.112 49226 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:01:45.154362 0.114780 tcp 10.0.2.112 49227 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:01:52.084512 0.067656 udp 10.0.2.112 50159 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 03:01:52.319562 0.137738 tcp 10.0.2.112 49228 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:02:10.488305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:14.493961 3.001997 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:08:21.501942 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:29.503469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:45.506446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:09:17.512102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:21.518133 3.002067 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:15:28.525805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:36.527593 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:52.530600 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:16:24.536027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:22:28.541953 3.002194 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:22:35.549952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:22:43.551255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:22:59.554198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:23:31.560728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:29:35.566044 3.002086 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:29:42.574083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:29:50.575197 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:30:06.578186 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:30:38.584415 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:31:45.022331 0.000092 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:31:45.022528 0.106422 tcp 10.0.2.112 49229 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:31:45.153065 0.108258 tcp 10.0.2.112 49230 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:36:42.590016 3.002140 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:36:49.597693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:36:57.599721 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:37:13.602323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:37:45.608227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:43:49.614031 3.002203 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:43:56.621906 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:04.623379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:20.626230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:52.632488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:50:56.638273 3.001552 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:51:03.645783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:51:11.647475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:51:27.650504 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:51:59.655875 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:03.662085 3.001465 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:58:10.669442 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:18.671072 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:34.674408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:59:06.680159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:01:45.029841 0.000058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:01:45.029945 0.115134 tcp 10.0.2.112 49231 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:01:45.168560 0.114893 tcp 10.0.2.112 49232 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:05:10.685954 3.001779 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:05:17.693879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:05:25.694750 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:05:41.698378 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:06:13.704436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:12:17.709385 3.002633 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:12:24.717194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:12:32.719231 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:12:48.722386 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:13:20.727920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:24.733870 3.001802 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:19:31.741877 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:39.743496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:55.745997 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:20:27.752028 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:26:31.758145 3.001879 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:26:38.765305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:26:46.766910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:27:02.770251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:27:34.776083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:31:45.037558 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:31:45.037742 0.108120 tcp 10.0.2.112 49233 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:31:45.174556 0.106003 tcp 10.0.2.112 49234 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:33:38.783316 3.000911 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:33:45.789270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:33:53.790847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:34:09.794336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:34:41.800038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:40:45.806103 3.001710 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:40:52.813490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:00.814821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:16.817764 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:48.823846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:47:52.829891 3.001426 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:47:59.837095 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:07.838763 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:23.841534 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:55.847726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:54:59.853740 3.002129 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:55:06.861437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:55:14.862878 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:55:30.865934 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:56:02.872201 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:01:45.045964 0.000129 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:01:45.046180 0.117683 tcp 10.0.2.112 49235 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:01:45.193542 0.108579 tcp 10.0.2.112 49236 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:02:06.877892 3.001857 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:02:13.885353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:02:21.887217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:02:37.889964 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:03:09.896126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:09:13.901587 3.001953 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:09:20.909229 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:09:28.910652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:09:44.913673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:10:16.919951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:20.925453 3.002151 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:16:27.933369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:35.934400 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:51.938094 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:17:23.943985 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:23:27.949641 3.002610 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:23:34.957049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:23:42.958825 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:23:58.962003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:24:30.967951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:30:34.974071 3.001561 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:30:41.981020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:30:49.982658 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:31:05.985889 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:31:37.992161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:31:45.053303 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:31:45.053482 0.115371 tcp 10.0.2.112 49237 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:45.193146 0.117492 tcp 10.0.2.112 49238 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:37:41.998466 3.000714 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:37:49.004940 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:37:57.006811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:38:13.009458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:38:45.015978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:44:49.021589 3.001434 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:44:56.028772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:04.031135 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:20.033560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:52.039637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:51:56.045604 3.001391 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:52:03.052963 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:52:11.054783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:52:27.057217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:52:59.063984 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:03.069749 3.001367 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:59:10.076847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:18.078190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:34.081304 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:00:06.087408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:01:45.061510 0.000090 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:01:45.061692 0.117372 tcp 10.0.2.112 49239 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:01:45.202715 0.117574 tcp 10.0.2.112 49240 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:06:10.094268 3.000694 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:06:17.100852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:06:25.102605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:06:41.105153 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:07:13.111528 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:13:17.117187 3.001958 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:13:24.125234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:13:32.126606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:13:48.129402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:14:20.135597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:24.141909 3.001405 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:20:31.148825 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:39.150892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:55.154023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:21:27.159585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:27:31.165450 3.001918 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:27:38.173137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:27:46.174298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:28:02.177741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:28:34.183399 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:31:45.070002 0.000064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:31:45.070114 0.117459 tcp 10.0.2.112 49241 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:31:45.210281 0.117096 tcp 10.0.2.112 49242 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:34:38.188922 3.002104 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:34:45.196887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:34:53.198739 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:35:09.201556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:35:41.207270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:41:45.212960 3.001960 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:41:52.220821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:00.222157 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:16.225731 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:48.231093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:48:52.237142 3.001662 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:48:59.244704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:07.246176 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:23.248979 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:55.255530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:55:59.261634 3.000991 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:56:06.269037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:56:14.270614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:56:30.273387 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:57:02.279688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:01:45.077627 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:01:45.077807 0.108111 tcp 10.0.2.112 49243 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:01:45.233363 0.117918 tcp 10.0.2.112 49244 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:01:51.689458 0.017267 udp 10.0.2.112 56118 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 07:01:51.707504 0.118313 tcp 10.0.2.112 49245 -> 37.19.5.65 80 FSPA* 0 0 13 5591 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:03:06.285243 3.001520 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:03:13.292921 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:03:21.294217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:03:37.296956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:04:09.303278 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:10:13.310556 3.000268 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:10:20.317067 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:10:28.318159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:10:44.321211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:11:16.327282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:20.333276 3.001956 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:17:27.341009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:35.342011 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:51.345126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:18:23.351225 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:27.357800 3.001026 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:24:34.364923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:42.366396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:58.369555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:25:30.375298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:31:34.381576 3.001515 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:31:41.388302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:31:45.085647 0.000064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:31:45.085856 0.117310 tcp 10.0.2.112 49246 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:31:45.225507 0.114901 tcp 10.0.2.112 49247 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:31:49.389995 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:32:05.392760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:32:37.399403 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:38:41.405171 3.001704 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:38:48.412676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:38:56.413697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:39:12.416787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:39:44.423037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:45:48.431081 2.999470 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:45:55.436534 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:03.437653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:19.441342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:51.446951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:52:55.452736 3.001932 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:53:02.460776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:53:10.462335 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:53:26.464838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:53:58.470857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:02.476535 3.002259 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:00:09.484099 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:17.485841 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:33.488608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:01:05.494716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:01:45.093358 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:01:45.093535 0.114883 tcp 10.0.2.112 49248 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:01:45.231333 0.114520 tcp 10.0.2.112 49249 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:07:09.500927 3.001751 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:07:16.508640 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:07:24.509966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:07:40.512689 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:08:12.518828 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:14:16.525343 3.001277 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:14:23.532747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:14:31.534048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:14:47.536571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:15:19.543011 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:23.548567 3.001979 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:21:30.556182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:38.558155 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:54.560744 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:22:26.566637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:28:30.572244 3.002406 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:28:37.580672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:28:45.582143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:29:01.584802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:29:33.590508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:31:45.101371 0.000084 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:31:45.101544 0.117719 tcp 10.0.2.112 49250 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:31:45.241704 0.117145 tcp 10.0.2.112 49251 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:35:37.596784 3.001876 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:35:44.604155 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:35:52.605956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:36:08.611284 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:36:40.614869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:42:44.620571 3.001556 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:42:51.628526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:42:59.630003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:43:15.632639 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:43:47.639209 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:49:51.644617 3.001465 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:49:58.652051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:06.653875 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:22.656570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:54.662548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:56:58.668726 3.001925 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:57:05.676195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:57:13.677857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:57:29.680955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:58:01.686378 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:01:45.109680 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:01:45.109962 0.114689 tcp 10.0.2.112 49252 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:01:45.247949 0.105971 tcp 10.0.2.112 49253 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:04:05.692447 3.001613 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:04:12.699815 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:04:20.701909 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:04:36.704515 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:05:08.710640 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:11:12.716279 3.001948 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:11:19.724349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:11:27.725260 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:11:43.729107 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:12:15.734837 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:19.740077 3.002164 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:18:26.748457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:34.749660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:50.752452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:19:22.758468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:26.764623 3.001543 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:25:33.772049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:41.773245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:57.776743 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:26:29.782699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:31:45.117527 0.000101 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:31:45.117719 0.114915 tcp 10.0.2.112 49254 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:31:45.261575 0.113658 tcp 10.0.2.112 49255 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:32:33.788461 3.002114 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:32:40.796078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:32:48.797483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:33:04.800837 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:33:36.806790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:39:40.812816 3.001602 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:39:47.820023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:39:55.821222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:40:11.824609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:40:43.830402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:46:47.835786 3.002512 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:46:54.844107 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:02.845771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:18.848711 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:50.854788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:53:54.860107 3.002162 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:54:01.867526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:09.869398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:25.872769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:57.878127 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:01.884843 3.001242 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:01:08.891933 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:16.893167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:32.896642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:45.129074 0.000092 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:01:45.129477 0.102586 tcp 10.0.2.112 49256 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:01:45.302801 0.114443 tcp 10.0.2.112 49257 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:02:04.902532 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:08.908105 3.002095 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:08:15.915637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:23.917305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:39.920326 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:09:11.926325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:15.932270 3.001837 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:15:22.939605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:30.941142 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:46.945159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:16:18.951185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:22.956158 3.002187 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:22:29.963781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:37.964908 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:53.968376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:23:25.973975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:29:29.980128 3.001705 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:29:36.987995 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:29:44.989111 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:30:00.994379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:30:32.998347 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:31:45.133804 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:31:45.133906 0.117420 tcp 10.0.2.112 49258 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:31:45.297012 0.105833 tcp 10.0.2.112 49259 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:36:37.005360 3.000199 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:36:44.012061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:36:52.013379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:37:08.016136 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:37:40.022560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:43:44.028214 3.001684 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:43:51.035591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:43:59.036904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:44:15.039879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:44:47.045887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:50:51.051888 3.002364 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:50:58.059917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:06.061447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:22.064175 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:54.069999 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:57:58.075745 3.001951 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:58:05.083773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:58:13.085415 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:58:29.088510 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:59:01.093836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:01:45.135124 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:01:45.135294 0.009721 udp 10.0.2.112 53712 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/01 11:01:45.140842 0.114979 tcp 10.0.2.112 49260 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:01:45.145859 0.484886 tcp 10.0.2.112 49261 -> 37.19.5.22 80 SPA_* 0 0 29 17628 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:01:45.279418 0.116926 tcp 10.0.2.112 49262 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:01:45.514681 0.009860 udp 10.0.2.112 62819 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/01 11:01:45.547344 0.107281 tcp 10.0.2.112 49263 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:01:51.693497 0.011311 udp 10.0.2.112 58224 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 11:01:51.705485 0.107369 tcp 10.0.2.112 49264 -> 37.19.5.65 80 FSPA* 0 0 13 5521 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:02:15.423297 0.000159 tcp 10.0.2.112 49261 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:02:20.380525 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:05:05.100158 3.001952 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 11:05:12.107458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:05:20.109158 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:05:36.112146 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:06:08.118058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:12:12.123683 3.002066 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:12:19.131398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:12:27.132899 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:12:43.136322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:13:15.142245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:19.147796 3.001786 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:19:26.155418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:34.157033 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:50.160270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:20:22.165880 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:26.172347 3.001652 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:26:33.179550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:41.180813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:57.183868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:27:29.189682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:31:45.150019 0.000095 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:31:45.150208 0.117005 tcp 10.0.2.112 49265 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:31:45.267359 0.000037 tcp 10.0.2.112 49261 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 11:31:45.297530 0.117241 tcp 10.0.2.112 49266 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:33:33.195982 3.001956 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:33:40.203092 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:33:48.204926 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:34:04.207564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:34:36.214279 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:40:40.219707 3.002193 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:40:47.227015 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:40:55.228697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:41:11.231702 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:41:43.237990 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:47:47.243266 3.002288 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:47:54.251308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:02.252786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:18.256288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:50.262218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:54:54.267694 3.001495 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:55:01.274988 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:09.276905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:25.280019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:57.285644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:01:45.158802 0.000093 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:01:45.159004 0.107956 tcp 10.0.2.112 49267 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:01:45.298310 0.117082 tcp 10.0.2.112 49268 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:02:01.292258 3.001380 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:02:08.299030 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:02:16.300978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:02:32.304202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:03:04.309825 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:09:08.315994 3.001166 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:09:15.323489 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:09:23.324893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:09:39.327892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:10:11.333726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:15.339678 3.001900 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:16:22.347020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:30.348699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:46.351389 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:17:18.357516 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:22.363365 3.002071 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:23:29.371004 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:37.372706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:53.375892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:24:25.381672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:30:29.407848 3.001806 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:30:36.414884 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:30:44.416362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:31:00.419446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:31:32.425671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:31:45.185673 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:31:45.185774 0.114671 tcp 10.0.2.112 49269 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:31:45.330241 0.103477 tcp 10.0.2.112 49270 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:37:36.432039 3.001161 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:37:43.439182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:37:51.440726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:38:07.443887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:38:39.449346 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:44:43.455602 3.001382 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:44:50.463070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:44:58.464859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:45:14.467687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:45:46.473883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:51:50.479176 3.002047 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:51:57.486709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:05.488365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:21.491814 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:53.497490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:58:57.504343 3.000978 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:59:04.511035 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:59:12.512169 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:59:28.515769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:00:00.521547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:01:45.194361 0.000087 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:01:45.194707 0.117288 tcp 10.0.2.112 49271 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:01:45.421213 0.116967 tcp 10.0.2.112 49272 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:06:04.528265 3.000905 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:06:11.534631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:06:19.536202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:06:35.539362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:07:07.545559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:13:11.551253 3.002260 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:13:18.559145 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:13:26.560381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:13:42.563343 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:14:14.569890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:20:18.576627 3.000177 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:20:25.583144 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:20:33.584357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:20:49.587738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:21:21.593414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:27:25.599098 3.001875 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:27:32.606950 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:27:40.608523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:27:56.611747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:28:28.617620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:31:45.202553 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:31:45.202667 0.116863 tcp 10.0.2.112 49273 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:31:45.395754 0.114821 tcp 10.0.2.112 49274 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:34:32.622863 3.001926 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:34:39.631173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:34:47.632379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:35:03.635649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:35:35.641167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:41:39.647108 3.002262 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:41:46.655153 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:41:54.656427 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:42:10.659373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:42:42.665397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:48:46.671363 3.001458 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:48:53.678500 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:01.680408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:17.683489 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:49.691476 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:55:53.695654 3.000989 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:56:00.702809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:08.704374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:24.707294 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:56.713058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:01:45.209510 0.000105 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:01:45.209699 0.116952 tcp 10.0.2.112 49275 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:01:45.367400 0.114885 tcp 10.0.2.112 49276 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:03:00.720228 3.000439 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:03:07.726723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:03:15.728189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:03:31.731034 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:04:03.737644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:10:07.743312 3.001326 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:10:14.751020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:10:22.752662 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:10:38.755208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:11:10.761565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:17:14.766912 3.001644 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:17:21.774376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:17:29.776481 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:17:45.779757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:18:17.785044 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:24:21.791093 3.001821 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:24:28.798894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:24:36.799755 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:24:52.803376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:25:24.809163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:31:28.815297 3.001178 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:31:35.822777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:31:43.824043 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:31:45.218305 0.000096 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:31:45.218504 0.117249 tcp 10.0.2.112 49277 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:31:45.369699 0.117132 tcp 10.0.2.112 49278 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:31:59.826979 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:32:31.833312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:38:35.839076 3.001481 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:38:42.846182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:38:50.847994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:39:06.850840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:39:38.857104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:45:42.863177 3.001582 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:45:49.870483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:45:57.871919 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:46:13.874900 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:46:45.880694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:52:49.886759 3.002210 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:52:56.894720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:04.896043 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:20.899282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:52.905018 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:59:56.910278 3.002719 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:00:03.918173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:11.919968 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:27.923326 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:59.929448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:01:45.225942 0.000097 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:01:45.226131 0.108093 tcp 10.0.2.112 49279 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:01:45.357256 0.108344 tcp 10.0.2.112 49280 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:01:51.717478 0.010038 udp 10.0.2.112 55482 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 15:01:51.728066 0.118348 tcp 10.0.2.112 49281 -> 37.19.5.65 80 FSPA* 0 0 13 5484 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:07:03.934510 3.002127 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:07:10.942362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:07:18.944139 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:07:34.946554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:08:06.952611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:14:10.959188 3.001859 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:14:17.966992 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:14:25.968195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:14:41.970770 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:15:13.976739 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:21:17.982211 3.002371 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:21:24.990021 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:21:32.991520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:21:48.995352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:22:21.000679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:28:25.006417 3.001955 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:28:32.014190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:28:40.015994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:28:56.018742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:29:28.024605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:31:45.234127 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:31:45.234399 0.116929 tcp 10.0.2.112 49282 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:31:45.379188 0.105944 tcp 10.0.2.112 49283 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:35:32.031660 3.001048 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:35:39.038561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:35:47.039659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:36:03.042656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:36:35.048594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:42:39.054215 3.001888 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:42:46.062116 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:42:54.064110 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:43:10.066397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:43:42.072957 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:49:46.078757 3.001891 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:49:53.086079 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:01.087648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:17.090852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:49.096835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:56:53.102668 3.001429 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:57:00.110417 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:08.112098 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:24.114846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:56.120583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:01:45.242111 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:01:45.242285 0.106021 tcp 10.0.2.112 49284 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:45.373132 0.114512 tcp 10.0.2.112 49285 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:04:00.127118 3.001081 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:04:07.134182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:04:15.135595 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:04:31.138539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:05:03.144889 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:11:07.150607 3.001962 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:11:14.158210 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:11:22.159464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:11:38.162712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:12:10.168786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:18:14.174311 3.001758 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:18:21.182391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:18:29.183849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:18:45.186695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:19:17.192465 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:25:21.198458 3.001447 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:25:28.206353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:25:36.207652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:25:52.210424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:26:24.217073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:31:45.249855 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:31:45.250135 0.114990 tcp 10.0.2.112 49286 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:31:45.388754 0.117410 tcp 10.0.2.112 49287 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:32:28.221907 3.002088 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:32:35.229716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:32:43.231865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:32:59.234215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:33:31.240594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:39:35.246186 3.002019 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:39:42.254113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:39:50.255635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:40:06.258589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:40:38.264545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:46:42.270434 3.001666 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:46:49.278108 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:46:57.279529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:47:13.282730 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:47:45.288963 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:53:49.294329 3.002209 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:53:56.301601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:04.303407 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:20.306170 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:52.312434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:00:56.317920 3.002052 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:01:03.326132 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:11.327565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:27.330585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:45.257719 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:01:45.258014 0.108192 tcp 10.0.2.112 49288 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:01:45.392731 0.116850 tcp 10.0.2.112 49289 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:01:59.336288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:08:03.342547 3.001162 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:08:10.349706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:08:18.351344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:08:34.354710 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:09:06.360496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:15:10.366275 3.001938 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:15:17.373593 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:15:25.375001 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:15:41.378480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:16:13.384238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:22:17.390434 3.001401 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:22:24.397792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:22:32.399440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:22:48.401909 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:23:20.407947 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:29:24.413745 3.001847 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:29:31.421445 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:29:39.423425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:29:55.426548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:30:27.432452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:31:45.266732 0.000146 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:31:45.266996 0.114819 tcp 10.0.2.112 49290 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:31:45.406284 0.117369 tcp 10.0.2.112 49291 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:36:31.438017 3.001991 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:36:38.445879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:36:46.447147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:37:02.449818 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:37:34.455961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:43:38.462037 3.001516 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:43:45.469464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:43:53.471095 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:44:09.474432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:44:41.480473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:50:45.485510 3.001963 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:50:52.493295 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:00.496659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:16.497980 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:48.504227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:57:52.511312 3.000677 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:57:59.517252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:07.519009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:23.521986 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:55.528390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:01:45.275078 0.000100 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:01:45.275281 0.105642 tcp 10.0.2.112 49292 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:01:45.406571 0.108032 tcp 10.0.2.112 49293 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:04:59.534107 3.001958 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:05:06.541507 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:05:14.543022 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:05:30.545829 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:06:02.552057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:12:06.559441 2.999939 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:12:13.565598 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:12:21.566920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:12:37.569948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:13:09.576003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:19:13.582144 3.001861 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:19:20.589172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:19:28.590790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:19:44.594048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:20:16.599993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:26:20.606125 3.001588 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:26:27.613453 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:26:35.614743 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:26:51.617863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:27:23.624193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:31:45.282770 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:31:45.283043 0.117399 tcp 10.0.2.112 49294 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:31:45.425102 0.114775 tcp 10.0.2.112 49295 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:33:27.630079 3.001848 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:33:34.637036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:33:42.639011 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:33:58.642125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:34:30.648228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:40:34.653366 3.002126 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:40:41.661001 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:40:49.663223 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:41:05.665807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:41:37.671854 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:47:41.678588 3.001152 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:47:48.685580 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:47:56.686806 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:48:12.690096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:48:44.695845 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:54:48.701744 3.001914 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:54:55.708984 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:03.710836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:19.713482 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:51.719550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:01:45.290304 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:01:45.290412 0.108735 tcp 10.0.2.112 49296 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:01:45.429171 0.150238 tcp 10.0.2.112 49297 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:01:51.721294 0.010569 udp 10.0.2.112 65155 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 19:01:51.732455 0.155645 tcp 10.0.2.112 49298 -> 37.19.5.65 80 FSPA* 0 0 13 5502 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:01:55.725445 3.002378 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:02:02.733036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:10.734834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:26.737509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:58.743433 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:09:02.749798 3.001428 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:09:09.757653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:09:17.759024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:09:33.761923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:10:05.767813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:16:09.773437 3.001814 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:16:16.781045 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:16:24.782705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:16:40.785520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:17:12.791869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:23:16.797117 3.002572 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:23:23.805150 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:23:31.806836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:23:47.809974 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:24:19.815984 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:30:23.822150 3.001317 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:30:30.829404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:30:38.830582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:30:54.833756 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:31:26.839642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:31:45.298322 0.000094 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:31:45.298514 0.153693 tcp 10.0.2.112 49299 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:31:45.475479 0.146637 tcp 10.0.2.112 49300 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:37:30.845193 3.002381 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:37:37.852763 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:37:45.854899 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:38:01.857775 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:38:33.867306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:44:37.870241 3.000833 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:44:44.877200 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:44:52.878469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:45:08.882017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:45:40.887549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:51:44.893924 3.001087 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:51:51.900910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:51:59.902590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:52:15.905269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:52:47.911733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:58:51.917338 3.001913 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:58:58.924824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:06.926712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:22.929824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:54.935865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:01:45.306215 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:01:45.306360 0.117613 tcp 10.0.2.112 49301 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:01:45.452050 0.115356 tcp 10.0.2.112 49302 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:05:58.940975 3.002250 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:06:05.948844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:06:13.950714 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:06:29.953643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:06:44.595928 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:06:44.596125 0.010021 udp 10.0.2.112 56595 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 20:06:44.606634 0.132366 tcp 10.0.2.112 49303 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:07:01.960190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:13:05.965961 3.001938 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:13:12.973016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:13:20.974732 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:13:36.977429 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:14:08.983470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:20:12.989271 3.002132 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:20:19.997212 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:20:27.998790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:20:44.001540 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:21:16.007164 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:27:20.013217 3.002028 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:27:27.020570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:27:35.022475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:27:51.025506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:28:23.031171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:31:45.315035 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:31:45.315260 0.114893 tcp 10.0.2.112 49304 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:31:45.454145 0.117372 tcp 10.0.2.112 49305 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:34:27.037317 3.001547 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:34:34.044878 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:34:42.046110 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:34:58.049208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:35:30.055630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:41:34.061584 3.001192 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:41:41.068760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:41:49.070569 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:42:05.073329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:42:37.079335 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:48:41.084631 3.002145 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:48:48.092366 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:48:56.094541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:49:12.097049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:49:44.103016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:55:48.109101 3.001561 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:55:55.117172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:03.117948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:19.121550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:51.126879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:01:45.013384 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:01:45.013546 0.009677 udp 10.0.2.112 63885 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/01 21:01:45.023683 0.164216 tcp 10.0.2.112 49306 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:01:45.321999 0.009988 udp 10.0.2.112 60505 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/01 21:01:45.332530 0.108553 tcp 10.0.2.112 49307 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:01:45.464917 0.117343 tcp 10.0.2.112 49308 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:01:45.673964 0.009957 udp 10.0.2.112 58823 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/01 21:01:45.684390 0.108898 tcp 10.0.2.112 49309 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:02:15.186893 0.000179 tcp 10.0.2.112 49306 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:02:19.900065 0.000072 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:02:55.132866 3.001980 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 21:03:02.140583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:10.141822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:26.145111 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:58.151094 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:10:02.157684 3.001209 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:10:09.164809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:10:17.166572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:10:33.168897 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:11:05.174940 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:17:09.181335 3.001267 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:17:16.188866 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:17:24.190420 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:17:40.193224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:18:12.198976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:24:16.205659 3.000894 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:24:23.212705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:24:31.213827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:24:47.217377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:25:19.223295 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:31:23.229088 3.001623 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:31:30.236228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:31:38.237929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:31:45.330814 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:31:45.331014 0.116877 tcp 10.0.2.112 49310 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:31:45.448077 0.000032 tcp 10.0.2.112 49306 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 21:31:45.479085 0.106094 tcp 10.0.2.112 49311 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:31:54.241459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:32:26.246868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:38:30.253312 3.001725 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:38:37.260759 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:38:45.262312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:39:01.264890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:39:33.271337 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:45:37.277355 3.000970 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:45:44.284516 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:45:52.286032 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:46:08.288920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:46:40.295108 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:52:44.300447 3.002222 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:52:51.308103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:52:59.309935 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:53:15.313382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:53:47.318610 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:59:51.325406 3.001416 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:59:58.332275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:06.334068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:22.337247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:54.342587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:01:45.338617 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:01:45.338715 0.116906 tcp 10.0.2.112 49312 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:01:45.485218 0.114695 tcp 10.0.2.112 49313 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:06:58.348466 3.001770 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:07:05.356053 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:07:13.357778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:07:29.360703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:08:01.367204 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:14:05.373273 3.001279 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:14:12.380102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:14:20.382194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:14:36.384961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:15:08.390852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:21:12.396863 3.001789 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:21:19.403974 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:21:27.405756 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:21:43.408422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:22:15.414800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:28:19.420351 3.005176 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:28:26.430642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:28:34.430027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:28:50.432677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:29:22.438490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:31:45.345887 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:31:45.346063 0.108508 tcp 10.0.2.112 49314 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:31:45.478410 0.116979 tcp 10.0.2.112 49315 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:35:26.444415 3.002358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:35:33.452424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:35:41.453504 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:35:57.457060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:36:29.462792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:42:33.468967 3.001474 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:42:40.476511 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:42:48.478030 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:43:04.480588 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:43:36.486725 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:49:40.492944 3.001450 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:49:47.499789 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:49:55.501742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:50:11.504409 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:50:43.510425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:56:47.516122 3.002274 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:56:54.523755 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:02.525627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:18.528746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:50.534758 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:01:45.354102 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:01:45.354254 0.114911 tcp 10.0.2.112 49316 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:01:45.492367 0.115206 tcp 10.0.2.112 49317 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:01:51.725228 0.010692 udp 10.0.2.112 62034 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/01 23:01:51.736459 0.116708 tcp 10.0.2.112 49318 -> 37.19.5.65 80 FSPA* 0 0 13 5377 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:03:54.541402 3.001171 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:04:01.548582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:09.549919 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:25.552821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:57.558381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:11:01.564935 3.001364 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:11:08.571692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:11:16.573234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:11:32.576464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:12:04.582342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:18:08.587935 3.002416 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:18:15.596049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:18:23.597805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:18:39.600774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:19:11.606874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:25:15.612574 3.001666 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:25:22.619951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:25:30.621275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:25:46.624639 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:26:18.630679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:31:45.362235 0.000093 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:31:45.362417 0.114876 tcp 10.0.2.112 49319 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:31:45.500745 0.117103 tcp 10.0.2.112 49320 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:32:22.636324 3.001685 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:32:29.643587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:32:37.645363 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:32:53.648556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:33:25.654192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:39:29.660967 3.001498 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:39:36.668004 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:39:44.669518 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:40:00.672361 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:40:32.678495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:46:36.683984 3.002421 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:46:43.692123 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:46:51.693105 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:47:07.696300 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:47:39.702600 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:53:43.708755 3.001177 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:53:50.715857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:53:58.717119 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:54:14.720004 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:54:46.726618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:00:50.732037 3.002328 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:00:57.740018 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:05.741324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:21.744565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:45.369824 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:01:45.370098 0.117368 tcp 10.0.2.112 49321 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:01:45.513176 0.115467 tcp 10.0.2.112 49322 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:01:53.750591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:07:57.756280 3.001439 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:08:04.764017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:08:12.765486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:08:28.767944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:09:00.774309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:15:04.780915 3.001382 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:15:11.787947 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:15:19.788908 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:15:35.792579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:16:07.798612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:22:11.803699 3.002038 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:22:18.811334 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:22:26.812826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:22:42.816102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:23:14.822003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:29:18.828227 3.001661 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:29:25.836023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:29:33.836951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:29:49.839989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:30:21.846007 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:31:45.378237 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:31:45.378521 0.117374 tcp 10.0.2.112 49323 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:31:45.526262 0.115225 tcp 10.0.2.112 49324 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:36:25.851884 3.001643 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:36:32.859715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:36:40.860830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:36:56.863905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:37:28.870426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:43:32.876991 3.000795 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:43:39.883228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:43:47.884727 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:44:03.888230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:44:35.894012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:50:39.900006 3.002092 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:50:46.907329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:50:54.909196 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:51:10.911951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:51:42.917841 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:57:46.923756 3.001941 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:57:53.931712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:01.933040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:17.936375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:49.941836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:01:45.386912 0.000098 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:01:45.387090 0.106293 tcp 10.0.2.112 49325 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:01:45.520028 0.117059 tcp 10.0.2.112 49326 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:04:53.948307 3.001245 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:05:00.957923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:08.957013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:24.960661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:56.966082 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:12:00.972888 3.000894 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:12:07.979470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:12:15.980776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:12:31.983858 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:13:03.989673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:19:07.995800 3.001485 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:19:15.003147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:19:23.005147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:19:39.008206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:20:11.013821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:26:15.019730 3.001533 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:26:22.027030 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:26:30.028762 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:26:46.032272 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:27:18.038150 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:31:45.394186 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:31:45.394404 0.117169 tcp 10.0.2.112 49327 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:31:45.537356 0.117361 tcp 10.0.2.112 49328 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:33:22.043678 3.002000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:33:29.051767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:33:37.052613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:33:53.056006 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:34:25.061723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:40:29.067918 3.001491 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:40:36.075623 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:40:44.076962 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:41:00.079635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:41:32.085517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:47:36.091987 3.001964 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:47:43.099306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:47:51.101014 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:48:07.103971 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:48:39.109478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:54:43.115735 3.001989 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:54:50.123438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:54:58.124381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:55:14.127798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:55:46.134114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:01:45.402615 0.000072 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:01:45.403007 0.106262 tcp 10.0.2.112 49329 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:01:45.540868 0.117223 tcp 10.0.2.112 49330 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:01:50.139416 3.001688 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:01:57.146845 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:05.149001 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:21.151785 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:53.158301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:08:57.164795 3.000447 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:09:04.170939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:09:12.172334 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:09:28.175581 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:10:00.181694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:16:04.187857 3.001499 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:16:11.195215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:16:19.196460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:16:35.199490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:17:07.405984 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:23:11.412313 3.001339 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:23:18.419527 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:23:26.420681 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:23:42.423539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:24:14.430296 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:30:18.436685 3.000818 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:30:25.443590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:30:33.444757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:30:49.447709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:31:21.453927 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:31:45.500155 0.000100 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:31:45.500344 0.114998 tcp 10.0.2.112 49331 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:31:45.644631 0.116813 tcp 10.0.2.112 49332 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:37:25.459948 3.001784 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:37:32.467537 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:37:40.468459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:37:56.471707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:38:28.478245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:44:32.483740 3.001742 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:44:39.491562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:44:47.492589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:45:03.496071 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:45:35.501748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:51:39.507816 3.001409 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:51:46.515113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:51:54.516535 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:52:10.519946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:52:42.525458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:58:46.531273 3.002211 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:58:53.538969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:01.540603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:17.543504 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:49.549747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:01:45.508361 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:01:45.508629 0.115546 tcp 10.0.2.112 49333 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:01:45.647725 0.106021 tcp 10.0.2.112 49334 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:01:51.820063 0.010253 udp 10.0.2.112 49155 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 03:01:51.830864 0.116204 tcp 10.0.2.112 49335 -> 37.19.5.65 80 FSPA* 0 0 13 5382 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:05:53.555421 3.002034 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:06:00.563719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:08.564370 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:24.568047 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:56.573898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:13:00.580355 3.000861 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:13:07.587344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:13:15.588523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:13:31.592103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:14:03.598137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:20:07.603379 3.002255 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:20:14.610939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:20:22.612489 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:20:38.615784 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:21:10.621717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:27:14.627839 3.001362 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:27:21.634769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:27:29.636760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:27:45.639679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:28:17.645968 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:31:45.516624 0.000110 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:31:45.516831 0.117286 tcp 10.0.2.112 49336 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:31:45.658648 0.108997 tcp 10.0.2.112 49337 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:34:21.651291 3.002300 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:34:28.658735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:34:36.660903 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:34:52.663190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:35:24.669743 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:41:28.675512 3.001465 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:41:35.682982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:41:43.684694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:41:59.687477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:42:31.693482 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:48:35.699420 3.001847 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:48:42.706709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:48:50.708291 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:49:06.711283 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:49:38.717210 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:55:42.723168 3.001657 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:55:49.730632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:55:57.732519 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:56:13.735625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:56:45.741820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:01:45.523999 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:01:45.524269 0.108278 tcp 10.0.2.112 49338 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:01:45.657858 0.117327 tcp 10.0.2.112 49339 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:02:49.746793 3.002497 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:02:56.754649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:04.756037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:20.759714 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:52.765420 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:09:56.771226 3.002180 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:10:03.779228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:10:11.780129 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:10:27.783581 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:10:59.789637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:17:03.795173 3.001774 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:17:10.802844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:17:18.804080 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:17:34.807309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:18:06.813053 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:24:10.818785 3.001890 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:24:17.826436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:24:25.828723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:24:41.831608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:25:13.837100 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:31:17.843129 3.002223 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:31:24.851164 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:31:32.852070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:31:45.532628 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:31:45.532774 0.117581 tcp 10.0.2.112 49340 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:31:45.673929 0.108398 tcp 10.0.2.112 49341 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:31:48.855433 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:32:20.861116 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:38:24.867983 3.000629 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:38:31.874970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:38:39.876462 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:38:55.879077 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:39:27.885558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:45:31.891738 3.001414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:45:38.898336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:45:46.900140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:46:02.903134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:46:34.909101 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:52:38.914671 3.002770 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:52:45.922402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:52:53.924178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:53:09.927173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:53:41.933371 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:59:45.938545 3.002254 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:59:52.946516 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:00.948056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:16.951492 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:48.957227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:01:45.540414 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:01:45.540673 0.115225 tcp 10.0.2.112 49342 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:01:45.680252 0.106337 tcp 10.0.2.112 49343 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:06:52.962803 3.001777 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:06:59.970667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:07.971904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:23.975087 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:55.981347 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:13:59.987640 3.001420 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:14:06.994445 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:14:14.996201 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:14:30.999286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:15:03.004828 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:21:07.010920 3.001790 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:21:14.018553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:21:22.020203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:21:38.022945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:22:10.028965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:28:14.034903 3.001545 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:28:21.042252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:28:29.045056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:28:45.047805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:29:17.052922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:31:45.548250 0.000080 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:31:45.548410 0.105808 tcp 10.0.2.112 49344 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:31:45.677891 0.108616 tcp 10.0.2.112 49345 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:35:21.058380 3.002299 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:35:28.066708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:35:36.067700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:35:52.070822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:36:24.077395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:42:28.082932 3.001540 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:42:35.090369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:42:43.091703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:42:59.094847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:43:31.101225 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:49:35.106603 3.001963 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:49:42.114037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:49:50.115827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:50:06.118773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:50:38.125083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:56:42.130562 3.002349 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:56:49.138660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:56:57.139819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:57:13.143198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:57:45.148722 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:01:45.556685 0.000044 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:01:45.556766 0.117496 tcp 10.0.2.112 49346 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:01:45.698343 0.115928 tcp 10.0.2.112 49347 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:03:49.155243 3.000985 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:03:56.162647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:04.163777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:20.166473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:52.172632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:10:56.179289 3.001653 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:11:03.186093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:11:11.187954 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:11:27.190697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:11:59.196707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:18:03.202714 3.001601 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:18:10.210315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:18:18.211898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:18:34.214510 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:19:06.221103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:25:10.227530 3.000798 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:25:17.234223 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:25:25.236096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:25:41.238525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:26:13.244881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:31:45.564520 0.000082 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:31:45.564683 0.115547 tcp 10.0.2.112 49348 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:31:45.703334 0.116062 tcp 10.0.2.112 49349 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:32:17.250791 3.001704 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:32:24.258421 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:32:32.260011 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:32:48.262659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:33:20.268452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:39:24.274890 3.001774 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:39:31.281945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:39:39.283638 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:39:55.286706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:40:27.292451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:46:31.298954 3.001066 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:46:38.305989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:46:46.308168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:47:02.310456 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:47:34.316783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:53:38.322332 3.002150 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:53:45.329820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:53:53.331513 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:54:09.335150 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:54:41.340969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:00:45.346064 3.002102 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:00:52.354395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:01:00.355746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:01:16.358851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:01:45.093771 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:01:45.093928 0.010006 udp 10.0.2.112 59178 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/02 07:01:45.104423 0.178012 tcp 10.0.2.112 49350 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:01:45.572101 0.010965 udp 10.0.2.112 58367 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/02 07:01:45.583516 0.106405 tcp 10.0.2.112 49351 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:01:45.713363 0.108572 tcp 10.0.2.112 49352 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:01:45.892070 0.106598 tcp 10.0.2.112 49353 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:01:48.364753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:01:51.823652 0.012865 udp 10.0.2.112 65156 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 07:01:51.837122 0.110335 tcp 10.0.2.112 49354 -> 37.19.5.65 80 FSPA* 0 0 13 5321 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:02:15.281874 0.000178 tcp 10.0.2.112 49350 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:02:19.980154 0.000100 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:07:52.370654 3.001866 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:07:59.378158 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:08:07.379562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:08:23.382326 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:08:55.388647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:14:59.395010 3.001255 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:15:06.402052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:15:14.403414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:15:30.406137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:16:02.722822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:22:06.728201 3.002722 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:22:13.736013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:22:21.737822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:22:37.740676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:23:09.746953 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:29:13.752750 3.001739 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:29:20.760602 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:29:28.762218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:29:44.764983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:30:16.770566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:31:45.730355 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:31:45.730458 0.116994 tcp 10.0.2.112 49355 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:31:45.847547 0.000025 tcp 10.0.2.112 49350 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/02 07:31:45.870733 0.117788 tcp 10.0.2.112 49356 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:36:20.777508 3.001013 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:36:27.784026 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:36:35.785704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:36:51.788449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:37:23.814643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:43:27.820864 3.001733 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:43:34.827976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:43:42.829821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:43:58.832722 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:44:30.838841 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:50:34.844370 3.001857 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:50:41.852624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:50:49.854037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:51:05.857101 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:51:37.862680 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:57:41.868490 3.001857 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:57:48.876530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:57:56.878133 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:58:12.880465 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:58:44.886449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:01:45.738249 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:01:45.738416 0.115079 tcp 10.0.2.112 49357 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:01:45.884703 0.108280 tcp 10.0.2.112 49358 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:04:48.893906 3.000760 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:04:55.900051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:05:03.901454 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:05:19.904383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:05:51.911059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:11:55.916296 3.002225 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:12:02.923925 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:12:10.925628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:12:26.929193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:12:58.934814 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:19:02.940643 3.001603 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:19:09.948637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:19:17.949738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:19:33.952858 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:20:05.958613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:26:09.964400 3.002180 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:26:16.971730 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:26:24.973408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:26:40.976796 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:27:12.982460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:31:45.746980 0.000125 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:31:45.747191 0.106610 tcp 10.0.2.112 49359 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:31:45.877054 0.116778 tcp 10.0.2.112 49360 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:33:16.988688 3.001751 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:33:23.996315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:33:31.997642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:33:48.000683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:34:20.006621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:40:24.012370 3.001645 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:40:31.020132 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:40:39.021907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:40:55.024322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:41:27.030594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:47:31.036845 3.001444 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:47:38.043912 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:47:46.045539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:48:02.048507 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:48:34.054281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:54:38.060301 3.001787 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:54:45.067607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:54:53.069226 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:55:09.072830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:55:41.078243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:01:45.084563 3.001688 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:01:45.754533 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:01:45.754708 0.115388 tcp 10.0.2.112 49361 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:01:45.895738 0.105958 tcp 10.0.2.112 49362 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:01:52.091768 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:02:00.093809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:02:16.096516 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:02:48.102499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:08:52.108074 3.002136 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:08:59.116118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:09:07.117179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:09:23.120370 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:09:55.126449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:15:59.132229 3.002269 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:16:06.139832 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:16:14.141498 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:16:30.144652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:17:02.150661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:23:06.156180 3.001783 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:23:13.163834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:23:21.168110 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:23:37.168701 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:24:09.174499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:30:13.180507 3.001553 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:30:20.187429 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:30:28.189046 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:30:44.192779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:31:16.199227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:31:45.762486 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:31:45.762653 0.106334 tcp 10.0.2.112 49363 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:31:45.892174 0.108737 tcp 10.0.2.112 49364 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:37:20.204478 3.001154 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:37:27.211657 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:37:35.212914 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:37:51.216073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:38:23.222177 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:44:27.230496 2.999346 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:44:34.236149 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:44:42.236849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:44:58.240195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:45:30.245939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:51:34.253771 3.000160 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:51:41.259885 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:51:49.260982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:52:05.264460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:52:37.270568 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:58:41.275924 3.001634 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:58:48.283684 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:58:56.285536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:59:12.288361 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:59:44.294208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:01:45.770708 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:01:45.770806 0.114918 tcp 10.0.2.112 49365 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:01:45.909620 0.105988 tcp 10.0.2.112 49366 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:05:48.299872 3.001978 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:05:55.307748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:06:03.309384 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:06:19.312109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:06:51.318271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:12:55.323537 3.002474 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:13:02.331550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:13:10.333443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:13:26.335723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:13:58.342495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:20:02.348191 3.001414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:20:09.355880 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:20:17.357337 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:20:33.360461 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:21:05.366258 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:27:09.371570 3.002465 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:27:16.379693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:27:24.380774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:27:40.384035 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:28:12.389871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:31:45.778362 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:31:45.778488 0.117486 tcp 10.0.2.112 49367 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:31:45.921107 0.108116 tcp 10.0.2.112 49368 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:34:16.396134 3.001832 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:34:23.403742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:34:31.404867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:34:47.408133 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:35:19.414013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:41:23.420782 3.000585 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:41:30.427507 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:41:38.429321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:41:54.432124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:42:26.438091 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:48:30.443399 3.002358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:48:37.451166 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:48:45.453231 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:49:01.455834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:49:33.462245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:55:37.467825 3.001423 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:55:44.475302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:55:52.476975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:56:08.480149 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:56:40.486056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:01:45.787257 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:01:45.787404 0.108409 tcp 10.0.2.112 49369 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:01:45.919870 0.117023 tcp 10.0.2.112 49370 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:01:51.977907 0.010186 udp 10.0.2.112 63477 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 11:01:51.988898 0.115969 tcp 10.0.2.112 49371 -> 37.19.5.65 80 FSPA* 0 0 13 5523 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:02:44.491774 3.001844 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:02:51.499515 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:02:59.500545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:03:15.504186 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:03:47.510003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:09:51.516398 3.000897 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:09:58.523316 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:10:06.524784 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:10:22.528269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:10:54.533530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:16:58.539709 3.001674 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:17:05.547455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:17:13.549123 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:17:29.552160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:18:01.558220 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:24:05.563699 3.001808 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:24:12.571005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:24:20.572844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:24:36.575628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:25:08.581983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:31:12.587374 3.002241 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:31:19.595721 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:31:27.596907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:31:43.599430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:31:45.794481 0.000069 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:31:45.794641 0.108973 tcp 10.0.2.112 49372 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:31:45.927300 0.106059 tcp 10.0.2.112 49373 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:32:15.605778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:38:19.611635 3.001582 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:38:26.619055 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:38:34.620624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:38:50.623958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:39:22.629374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:45:26.635418 3.001828 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:45:33.642766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:45:41.644506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:45:57.648185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:46:29.653937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:52:33.661010 3.000608 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:52:40.667526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:52:48.668838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:53:04.671895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:53:36.677502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:59:40.682968 3.002646 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:59:47.690875 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:59:55.692255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:00:11.695951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:00:43.701876 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:01:45.802412 0.000109 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:01:45.802609 0.117435 tcp 10.0.2.112 49374 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:01:45.946329 0.117031 tcp 10.0.2.112 49375 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:06:47.707780 3.001805 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:06:54.715036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:07:02.716751 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:07:18.719760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:07:50.725941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:13:54.731246 3.002016 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:14:01.738737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:14:09.740704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:14:25.743156 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:14:57.749330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:21:01.756861 3.000325 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:21:08.763047 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:21:16.764754 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:21:32.767682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:22:04.773558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:28:08.779815 3.001476 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:28:15.786563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:28:23.788432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:28:39.791817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:29:11.797844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:31:45.810528 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:31:45.810705 0.115144 tcp 10.0.2.112 49376 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:31:45.952672 0.114608 tcp 10.0.2.112 49377 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:35:15.803571 3.001656 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:35:22.811330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:35:30.812096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:35:46.815505 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:36:18.821512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:42:22.827683 3.001285 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:42:29.834894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:42:37.836725 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:42:53.839652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:43:25.845470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:49:29.851889 3.001126 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:49:36.858460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:49:44.860339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:50:00.863193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:50:32.869038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:56:36.874665 3.002084 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:56:43.882763 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:56:51.884069 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:57:07.887331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:57:39.893372 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:01:45.820788 0.000052 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:01:45.820899 0.117879 tcp 10.0.2.112 49378 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:01:45.970338 0.117476 tcp 10.0.2.112 49379 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:03:43.899120 3.001503 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:03:50.907040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:03:58.908354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:04:14.911376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:04:47.087674 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:10:51.094740 3.000793 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:10:58.101205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:11:06.102244 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:11:22.105884 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:11:54.111547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:17:58.117534 3.001948 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:18:05.124707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:18:13.126070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:18:29.129613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:19:01.135671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:25:05.140888 3.001890 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:25:12.148828 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:25:20.150565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:25:36.153853 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:26:08.159325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:31:45.906943 0.000043 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:31:45.907046 0.108647 tcp 10.0.2.112 49380 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:31:46.039831 0.108257 tcp 10.0.2.112 49381 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:32:12.164760 3.002431 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:32:19.172910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:32:27.174552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:32:43.177315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:33:15.183485 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:39:19.190242 3.000810 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:39:26.196672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:39:34.197974 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:39:50.201383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:40:22.207500 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:46:26.212997 3.002048 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:46:33.220550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:46:41.222573 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:46:57.225644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:47:29.231207 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:53:33.237495 3.001551 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:53:40.244464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:53:48.246449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:54:04.249029 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:54:36.255454 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:00:40.261052 3.002012 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:00:47.269495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:00:55.270794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:01:11.273953 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:01:43.279422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:01:45.914906 0.000043 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:01:45.915004 0.117451 tcp 10.0.2.112 49382 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:01:46.065430 0.114729 tcp 10.0.2.112 49383 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:07:47.284599 3.001960 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:07:54.292742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:08:02.293887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:08:18.296997 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:08:50.303523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:14:54.309879 3.000972 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:15:01.316987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:15:09.317805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:15:25.321013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:15:57.327426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:22:01.333109 3.001849 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:22:08.340673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:22:16.342289 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:22:32.345305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:23:04.350866 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:29:08.357063 3.001920 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:29:15.364650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:29:23.366199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:29:39.369198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:30:11.374872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:31:45.923251 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:31:45.923414 0.114916 tcp 10.0.2.112 49384 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:31:46.062378 0.106232 tcp 10.0.2.112 49385 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:36:15.380957 3.001795 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:36:22.388208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:36:30.390315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:36:46.393367 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:37:18.398993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:43:22.404474 3.002390 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:43:29.412255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:43:37.414301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:43:53.416691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:44:25.423379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:50:29.428398 3.002321 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:50:36.436148 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:50:44.498130 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:51:00.501262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:51:32.507264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:57:36.512615 3.002432 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:57:43.520737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:57:51.522124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:58:07.525541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:58:39.530847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:01:45.950643 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:01:45.950785 0.114999 tcp 10.0.2.112 49386 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:01:46.089782 0.108381 tcp 10.0.2.112 49387 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:01:52.083924 0.009958 udp 10.0.2.112 50042 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 15:01:52.094700 0.118633 tcp 10.0.2.112 49388 -> 37.19.5.65 80 FSPA* 0 0 13 5481 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:04:43.537265 3.001592 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:04:50.544312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:04:58.545928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:05:14.549071 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:05:46.554703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:11:50.560538 3.001864 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:11:57.568634 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:12:05.570116 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:12:21.573093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:12:53.579125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:18:57.584927 3.001620 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:19:04.592502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:19:12.593925 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:19:28.597102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:20:00.603187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:26:04.608485 3.002134 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:26:11.616398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:26:19.617527 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:26:35.621084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:27:07.626884 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:31:45.958774 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:31:45.959112 0.108252 tcp 10.0.2.112 49389 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:31:46.094592 0.115126 tcp 10.0.2.112 49390 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:33:11.633043 3.001792 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:33:18.640093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:33:26.642009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:33:42.644691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:34:14.651131 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:40:18.656833 3.001971 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:40:25.664468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:40:33.666167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:40:49.668631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:41:21.674608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:47:25.680668 3.001976 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:47:32.688308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:47:40.690102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:47:56.692965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:48:28.698996 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:54:32.704304 3.002379 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:54:39.712109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:54:47.713964 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:55:03.716663 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:55:35.722634 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:01:39.728805 3.002059 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:01:45.966643 0.000115 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:01:45.966885 0.117152 tcp 10.0.2.112 49391 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:01:46.110128 0.108039 tcp 10.0.2.112 49392 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:01:46.736622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:01:54.737734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:02:10.740683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:02:42.747000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:08:46.754391 3.000189 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:08:53.760317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:09:01.761360 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:09:17.764793 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:09:49.770565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:15:53.776148 3.002153 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:16:00.783844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:16:08.785457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:16:24.788862 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:16:56.795217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:23:00.801348 3.000689 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:23:07.808468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:23:15.809274 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:23:31.812529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:24:03.818862 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:30:07.824419 3.002032 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:30:14.832113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:30:22.833562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:30:38.836850 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:31:10.842766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:31:45.974762 0.000131 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:31:45.974989 0.117186 tcp 10.0.2.112 49393 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:31:46.115908 0.108430 tcp 10.0.2.112 49394 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:37:14.848059 3.001894 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:37:21.856073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:37:29.857888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:37:45.860947 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:38:17.867141 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:44:21.872857 3.001414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:44:28.879871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:44:36.881508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:44:52.884393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:45:24.890588 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:51:28.896192 3.001753 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:51:35.903654 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:51:43.905339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:51:59.908803 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:52:31.914876 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:58:35.922030 3.000334 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:58:42.928012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:58:50.929331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:59:06.932591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:59:38.938442 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:01:45.346200 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:01:45.346319 0.009686 udp 10.0.2.112 49898 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/02 17:01:45.356609 0.177171 tcp 10.0.2.112 49395 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:45.982585 0.010219 udp 10.0.2.112 61267 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/02 17:01:45.993278 0.117313 tcp 10.0.2.112 49396 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:46.141824 0.114132 tcp 10.0.2.112 49397 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:46.242208 0.115544 tcp 10.0.2.112 49398 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:02:15.534077 0.000174 tcp 10.0.2.112 49395 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:02:20.220366 0.000161 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:05:42.943832 3.002534 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/02 17:05:49.951987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:05:57.953608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:06:13.956454 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:06:45.962317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:12:49.968353 3.002056 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:12:56.976003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:13:04.977611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:13:20.980694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:13:52.986481 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:19:56.992180 3.001675 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:20:03.999976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:20:12.001635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:20:28.004005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:21:00.010567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:27:04.015916 3.001879 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:27:11.023585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:27:19.025303 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:27:35.028538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:28:07.034303 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:31:45.999342 0.000088 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:31:45.999528 0.117358 tcp 10.0.2.112 49399 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:31:46.116914 0.000043 tcp 10.0.2.112 49395 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/02 17:31:46.140651 0.114944 tcp 10.0.2.112 49400 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:34:11.040125 3.002027 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:34:18.048098 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:34:26.048888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:34:42.052591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:35:14.058328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:41:18.064646 3.001343 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:41:25.071628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:41:33.073084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:41:49.076030 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:42:21.082440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:48:25.088235 3.001483 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:48:32.095939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:48:40.096846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:48:56.100513 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:49:28.106194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:55:32.112318 3.001912 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:55:39.119627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:55:47.120929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:56:03.124583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:56:35.130316 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:01:45.999433 0.000047 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:01:45.999535 0.105792 tcp 10.0.2.112 49401 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:01:46.130293 0.115234 tcp 10.0.2.112 49402 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:02:39.136050 3.002032 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:02:46.143972 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:02:54.145113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:03:10.148501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:03:42.156017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:09:46.159972 3.001852 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:09:53.170385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:10:01.169206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:10:17.172170 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:10:49.177971 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:16:53.184011 3.001956 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:17:00.192028 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:17:08.193523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:17:24.196189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:17:56.202348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:24:00.208092 3.001791 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:24:07.215665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:24:15.217012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:24:31.220358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:25:03.226466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:31:07.233536 3.000186 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:31:14.239229 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:31:22.241174 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:31:38.244320 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:31:46.007575 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:31:46.007776 0.108328 tcp 10.0.2.112 49403 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:31:46.140198 0.117463 tcp 10.0.2.112 49404 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:32:10.250603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:38:14.255965 3.001477 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:38:21.263211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:38:29.265238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:38:45.267984 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:39:17.274408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:45:21.280909 3.000908 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:45:28.287437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:45:36.289165 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:45:52.292515 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:46:24.968898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:52:28.975243 3.001459 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:52:35.982478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:52:43.984063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:52:59.987187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:53:31.992558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:59:35.999859 3.001000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:59:43.006477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:59:51.007903 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:00:07.011054 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:00:39.016658 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:01:46.336909 0.000129 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:01:46.337135 0.108171 tcp 10.0.2.112 49405 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:01:46.469684 0.108807 tcp 10.0.2.112 49406 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:01:52.406398 0.010527 udp 10.0.2.112 50248 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 19:01:52.417586 0.118795 tcp 10.0.2.112 49407 -> 37.19.5.65 80 FSPA* 0 0 13 5482 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:06:43.022699 3.001626 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:06:50.030327 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:06:58.031565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:07:14.034554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:07:46.040512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:13:50.046792 3.001560 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:13:57.054080 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:14:05.055591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:14:21.058813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:14:53.064917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:20:57.071519 3.000700 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:21:04.078424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:21:12.079549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:21:28.083002 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:22:00.088796 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:28:04.094388 3.002180 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:28:11.101900 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:28:19.103591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:28:35.106645 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:29:07.112793 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:31:46.343240 0.000078 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:31:46.343392 0.117287 tcp 10.0.2.112 49408 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:31:46.484677 0.117438 tcp 10.0.2.112 49409 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:35:11.118079 3.002559 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:35:18.125865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:35:26.127329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:35:42.130836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:36:14.136714 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:42:18.143176 3.001481 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:42:25.150262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:42:33.151293 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:42:49.154483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:43:21.160821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:49:25.167530 3.000415 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:49:32.173854 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:49:40.175682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:49:56.178738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:50:28.184555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:56:32.190376 3.001852 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:56:39.197999 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:56:47.199511 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:57:03.202741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:57:35.208568 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:01:46.351205 0.000076 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:01:46.351366 0.106290 tcp 10.0.2.112 49410 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:01:46.490793 0.114903 tcp 10.0.2.112 49411 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:03:39.214067 3.002555 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:03:46.222094 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:03:54.223700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:04:10.226796 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:04:42.232206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:06:45.783845 0.002366 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:06:45.786262 0.010064 udp 10.0.2.112 62720 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 20:06:45.796912 0.132891 tcp 10.0.2.112 49412 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:10:46.238152 3.002170 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:10:53.245981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:11:01.247993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:11:17.250264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:11:49.256848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:17:53.263086 3.001454 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:18:00.269821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:18:08.271757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:18:24.274102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:18:56.280686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:25:00.286497 3.001747 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:25:07.294029 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:25:15.295520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:25:31.298514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:26:03.304169 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:31:46.359840 0.000138 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:31:46.360059 0.115153 tcp 10.0.2.112 49413 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:31:46.500552 0.105827 tcp 10.0.2.112 49414 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:32:07.309848 3.002008 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:32:14.318381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:32:22.319216 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:32:38.322164 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:33:10.328158 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:39:14.333960 3.002326 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:39:21.341884 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:39:29.343306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:39:45.346617 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:40:17.352150 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:46:21.359632 3.000850 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:46:28.366409 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:46:36.367371 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:46:52.370527 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:47:24.376350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:53:28.382691 3.001114 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:53:35.389848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:53:43.391765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:53:59.394201 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:54:31.400170 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:00:35.405811 3.001779 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:00:42.413629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:00:50.415298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:01:06.417956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:01:38.424147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:01:46.367795 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:01:46.367965 0.106046 tcp 10.0.2.112 49415 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:01:46.497838 0.108175 tcp 10.0.2.112 49416 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:07:42.431500 3.000932 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:07:49.437615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:07:57.438879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:08:13.442633 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:08:45.448159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:14:49.455127 3.000774 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:14:56.461879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:15:04.462807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:15:20.466104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:15:52.472115 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:21:56.478221 3.001464 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:22:03.485796 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:22:11.486805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:22:27.490441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:22:59.496596 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:29:03.501651 3.002424 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:29:10.509943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:29:18.510737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:29:34.513871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:30:06.519978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:31:46.376029 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:31:46.376221 0.114943 tcp 10.0.2.112 49417 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:31:46.514609 0.117544 tcp 10.0.2.112 49418 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:36:10.525976 3.001957 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:36:17.533480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:36:25.535551 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:36:41.538390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:37:13.543847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:43:17.550101 3.001461 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:43:24.558146 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:43:32.558844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:43:48.562354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:44:20.568323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:50:24.573939 3.001950 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:50:31.581813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:50:39.582958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:50:55.585934 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:51:27.592357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:57:31.597784 3.001924 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:57:38.606392 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:57:46.607728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:58:02.610043 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:58:34.616410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:01:46.383675 0.000068 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:01:46.383818 0.108219 tcp 10.0.2.112 49419 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:01:46.520528 0.117831 tcp 10.0.2.112 49420 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:04:38.622742 3.000553 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:04:45.629520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:04:53.631375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:05:09.633619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:05:41.640426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:11:45.645758 3.002020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:11:52.653770 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:12:00.654839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:12:16.657859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:12:48.663713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:18:52.669759 3.002113 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:18:59.677567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:19:07.679109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:19:23.681659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:19:55.687562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:25:59.695049 3.000156 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:26:06.701065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:26:14.702475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:26:30.705996 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:27:02.711852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:31:46.392427 0.000051 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:31:46.392536 0.117330 tcp 10.0.2.112 49421 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:31:46.533811 0.117023 tcp 10.0.2.112 49422 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:33:06.718311 3.002783 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:33:13.726778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:33:21.726579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:33:37.729811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:34:09.736096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:40:13.741502 3.002094 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:40:20.749479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:40:28.750678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:40:44.753405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:41:16.759596 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:47:20.765598 3.001495 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:47:27.773171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:47:35.774965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:47:51.777995 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:48:23.784198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:54:27.789773 3.001435 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:54:34.796814 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:54:42.798354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:54:58.802071 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:55:30.808005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:01:34.815148 3.000565 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:01:41.821041 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:01:46.399299 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:01:46.399462 0.117560 tcp 10.0.2.112 49423 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:01:46.541854 0.108542 tcp 10.0.2.112 49424 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:01:49.822357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:01:52.410688 0.009804 udp 10.0.2.112 50683 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/02 23:01:52.421104 0.107383 tcp 10.0.2.112 49425 -> 37.19.5.65 80 FSPA* 0 0 13 5602 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:02:05.825866 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:02:37.831834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:08:41.837081 3.002453 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:08:48.845377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:08:56.846583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:09:12.849405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:09:44.855443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:15:48.861073 3.002490 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:15:55.868755 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:16:03.870882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:16:19.873713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:16:51.879594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:22:55.885515 3.001487 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:23:02.892782 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:23:10.894759 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:23:26.897771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:23:58.903248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:30:02.909395 3.002029 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:30:09.916726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:30:17.918565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:30:33.921655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:31:05.927848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:31:46.407523 0.000073 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:31:46.407852 0.105929 tcp 10.0.2.112 49426 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:31:46.540083 0.117689 tcp 10.0.2.112 49427 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:37:09.933042 3.002455 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:37:16.940620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:37:24.942609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:37:40.945305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:38:12.951730 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:44:16.957673 3.001466 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:44:23.964707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:44:31.967068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:44:47.969383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:45:19.975113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:51:23.982088 3.001236 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:51:30.988686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:51:38.990589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:51:54.993134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:52:26.999835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:58:31.005306 3.001863 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:58:38.012883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:58:46.014391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:59:02.017441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:59:34.024023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:01:46.416455 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:01:46.416564 0.115503 tcp 10.0.2.112 49428 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:01:46.555573 0.115267 tcp 10.0.2.112 49429 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:05:38.029535 3.001211 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:05:45.037232 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:05:53.038466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:06:09.041647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:06:41.047469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:12:45.052902 3.001951 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:12:52.060885 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:13:00.062119 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:13:16.065611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:13:48.071667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:19:52.077171 3.001598 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:19:59.084461 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:20:07.086355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:20:23.089344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:20:55.095525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:26:59.100918 3.002121 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:27:06.108502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:27:14.110095 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:27:30.113227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:28:02.119582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:31:46.423588 0.000052 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:31:46.423836 0.117527 tcp 10.0.2.112 49430 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:31:46.567984 0.115106 tcp 10.0.2.112 49431 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:34:06.134939 3.002335 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:34:13.142771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:34:21.144461 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:34:37.147014 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:35:09.153459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:41:13.159336 3.001951 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:41:20.166951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:41:28.168292 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:41:44.171203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:42:16.177495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:48:20.184467 3.000607 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:48:27.190488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:48:35.191780 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:48:51.195057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:49:23.201166 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:55:27.208747 3.000177 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:55:34.214550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:55:42.216247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:55:58.219398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:56:30.225061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:01:46.441812 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:01:46.441927 0.117608 tcp 10.0.2.112 49432 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:01:46.585014 0.116779 tcp 10.0.2.112 49433 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:02:34.231042 3.001529 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:02:41.238800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:02:49.239895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:03:05.242826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:03:37.248944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:09:41.254507 3.002126 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:09:48.263163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:09:56.263928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:10:12.266872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:10:44.273342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:16:48.280126 3.000522 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:16:55.286524 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:17:03.287855 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:17:19.290676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:17:51.296701 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:23:55.303010 3.001719 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:24:02.310466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:24:10.312010 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:24:26.314789 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:24:58.321090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:31:02.327700 3.001222 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:31:09.334501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:31:17.336062 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:31:33.338618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:31:46.450148 0.000076 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:31:46.450274 0.108905 tcp 10.0.2.112 49434 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:46.582360 0.108233 tcp 10.0.2.112 49435 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:05.344787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:38:09.351033 3.001854 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:38:16.358594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:38:24.360447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:38:40.362977 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:39:12.368990 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:45:16.375076 3.282282 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:45:23.662557 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:45:31.664252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:45:47.666907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:46:19.673270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:52:23.678961 3.001925 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:52:30.686393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:52:38.688330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:52:54.691469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:53:26.696919 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:59:30.702902 3.001674 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:59:37.710711 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:59:45.711834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:00:01.715165 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:00:33.721606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:01:46.588936 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:01:46.589051 0.117596 tcp 10.0.2.112 49436 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:01:46.732193 0.117739 tcp 10.0.2.112 49437 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:37.727970 3.001217 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:06:44.734627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:06:52.736164 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:07:08.739314 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:07:40.745861 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:13:44.751933 3.000670 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:13:51.758800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:13:59.760495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:14:23.521364 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:14:56.480536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:21:13.070100 3.164733 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:21:20.184170 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:21:28.080794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:22:40.619868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:23:12.253222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:29:15.000310 3.001001 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:29:22.007423 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:29:30.009161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:29:46.011738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:30:18.017737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:33:02.736697 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:33:02.759885 1.837761 tcp 10.0.2.112 49438 -> 37.19.5.10 80 FSPA* 0 0 11 996 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:33:02.987625 0.108609 tcp 10.0.2.112 49439 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:36:22.024196 3.001253 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:36:29.031219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:36:37.032659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:36:53.035907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:37:25.041794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:43:29.066926 2.990750 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:43:36.055167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:43:44.056637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:44:00.059826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:44:32.065633 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:50:36.072322 3.001187 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:50:43.079068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:50:51.080363 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:51:07.083845 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:51:39.090127 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:57:43.098413 2.998919 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:57:50.103009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:57:58.104773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:58:14.107787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:58:46.113997 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:03:01.946742 0.000106 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:03:01.946940 0.009989 udp 10.0.2.112 63628 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/03 03:03:01.957495 0.434022 tcp 10.0.2.112 49440 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:02.744216 0.011535 udp 10.0.2.112 58169 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/03 03:03:02.756195 0.117071 tcp 10.0.2.112 49441 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:02.899734 0.117263 tcp 10.0.2.112 49442 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:02.961880 0.010252 udp 10.0.2.112 50320 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/03 03:03:02.972847 0.115447 tcp 10.0.2.112 49443 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:08.715692 0.017827 udp 10.0.2.112 65433 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 03:03:08.734298 0.116450 tcp 10.0.2.112 49444 -> 37.19.5.65 80 FSPA* 0 0 13 5578 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:32.158261 0.000177 tcp 10.0.2.112 49440 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:36.912812 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:04:50.119968 3.000811 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/03 03:04:57.211956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:05:05.147160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:05:21.131522 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:05:53.137526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:11:57.144665 3.000549 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:12:04.151033 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:12:12.152792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:12:28.155614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:13:00.161852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:19:04.166924 3.002347 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:19:11.175014 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:19:19.176438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:19:35.179402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:20:07.185749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:26:11.191447 3.002193 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:26:18.198966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:26:26.200179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:26:42.203703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:27:14.209090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:33:02.753214 0.000112 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:33:02.753426 0.115372 tcp 10.0.2.112 49445 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:33:02.868933 0.000088 tcp 10.0.2.112 49440 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 03:33:02.892586 0.115259 tcp 10.0.2.112 49446 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:33:39.227274 3.000124 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:33:46.232981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:33:54.234611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:34:10.237732 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:34:42.244475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:40:55.251819 3.002369 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:41:02.259607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:41:10.261442 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:41:26.264765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:41:58.270728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:48:05.282704 2.999757 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:48:12.288245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:48:20.290063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:48:36.292921 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:49:08.298416 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:55:12.304670 3.002005 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:55:19.312333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:55:27.313960 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:55:43.316824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:56:15.323180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:02:19.328977 3.001648 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:02:26.340743 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:02:34.337795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:02:50.341192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:03:02.760997 0.000040 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:03:02.761095 0.105687 tcp 10.0.2.112 49447 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:03:02.892906 0.107988 tcp 10.0.2.112 49448 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:03:22.346927 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:09:26.353259 3.001285 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:09:33.360279 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:09:41.361594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:09:57.366618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:10:29.370691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:16:33.377149 3.001216 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:16:40.384295 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:16:48.385813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:17:04.388621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:17:36.395072 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:06.167211 2.964473 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:24:13.088327 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:20.990350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:36.794863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:25:08.424571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:31:12.433479 2.998999 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:31:19.465938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:31:27.440791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:31:43.442500 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:32:15.448715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:33:02.769859 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:33:02.770047 0.108296 tcp 10.0.2.112 49449 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:33:02.904573 0.108420 tcp 10.0.2.112 49450 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:38:19.455057 3.001171 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:38:26.462074 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:38:34.463719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:38:50.466583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:39:22.472639 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:45:26.479229 3.001122 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:45:33.486066 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:45:41.487691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:45:57.490841 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:46:29.502778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:52:33.503865 3.003506 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:52:40.512053 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:52:48.511697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:53:04.514856 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:53:36.520720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:59:40.526175 3.002079 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:59:47.534113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:59:55.535865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:00:11.538305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:00:43.544349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:03:02.776918 0.000078 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:03:02.777079 0.117548 tcp 10.0.2.112 49451 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:03:02.920778 0.106684 tcp 10.0.2.112 49452 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:06:47.550780 3.001169 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:06:54.557836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:02.559377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:18.562641 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:50.568496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:13:54.575347 3.000894 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:14:01.582037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:14:09.583903 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:14:25.586308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:14:57.592646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:01.599085 3.000863 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:21:08.605956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:16.607475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:32.610493 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:22:04.616411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:28:08.622996 3.006488 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:28:15.630388 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:28:23.630708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:28:39.636448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:29:11.640262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:33:02.785531 0.000041 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:33:02.785623 0.106435 tcp 10.0.2.112 49453 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:33:02.916192 0.105849 tcp 10.0.2.112 49454 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:35:15.646517 3.001655 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:35:22.653830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:35:30.655440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:35:46.658226 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:36:18.664234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:42:22.671372 3.000543 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:42:29.677896 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:42:37.679340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:42:53.682190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:43:25.688333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:49:29.694326 3.001734 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:49:36.702450 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:49:44.703262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:50:00.706271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:50:32.712299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:56:36.718619 3.001383 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:56:43.725983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:56:51.727470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:57:07.730085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:57:39.736153 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:03:02.793045 0.000078 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:03:02.793207 0.115199 tcp 10.0.2.112 49455 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:03:02.933373 0.117661 tcp 10.0.2.112 49456 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:03:43.743284 3.001274 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:03:50.749740 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:03:58.751395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:04:14.754185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:04:46.759975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:10:50.766422 3.001404 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:10:57.776994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:11:05.775169 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:11:21.778272 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:11:53.784272 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:17:57.790796 3.000930 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:18:04.797694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:18:12.799129 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:18:28.802086 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:19:00.808289 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:04.815505 3.002542 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:25:11.821357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:19.823298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:35.826206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:26:07.832144 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:32:11.838329 3.002982 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:32:18.845518 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:32:26.847273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:32:42.849957 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:33:02.801222 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:33:02.801406 0.108209 tcp 10.0.2.112 49457 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:33:02.932960 0.117349 tcp 10.0.2.112 49458 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:33:14.858270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:39:18.863582 3.000475 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:39:25.869504 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:39:33.871203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:39:49.876143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:40:21.880025 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:46:29.894724 2.998845 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:46:36.900678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:46:44.900606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:47:00.904120 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:47:32.909717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:53:36.916468 3.001247 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:53:43.923127 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:53:51.924792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:54:07.928379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:54:39.933938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:00:43.940124 3.001325 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:00:50.947619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:00:58.948565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:01:14.951565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:01:46.957538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:03:02.809184 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:03:02.809309 0.117408 tcp 10.0.2.112 49459 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:03:02.952752 0.117904 tcp 10.0.2.112 49460 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:03:08.700288 0.010035 udp 10.0.2.112 57305 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 07:03:08.711294 0.118243 tcp 10.0.2.112 49461 -> 37.19.5.65 80 FSPA* 0 0 13 5599 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:07:50.965215 3.000324 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:07:57.971177 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:05.972625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:21.975571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:53.981672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:14:57.988552 3.000863 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:15:04.994944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:15:12.996675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:15:28.999799 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:16:01.006025 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:23:19.018434 3.001258 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:23:26.025993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:23:34.027321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:23:50.030013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:24:22.035936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:30:51.048822 3.000934 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:30:58.057517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:31:06.056605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:31:22.059470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:31:54.065734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:33:02.817174 0.000100 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:33:02.817370 0.108946 tcp 10.0.2.112 49462 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:33:02.950553 0.114944 tcp 10.0.2.112 49463 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:37:58.072132 3.001719 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:38:05.079271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:38:13.081358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:38:29.083894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:39:01.090005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:45:07.098722 3.001448 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:45:14.106054 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:45:22.107530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:45:38.110394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:46:10.116664 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:52:18.129911 3.000005 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:52:25.135826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:52:33.137224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:52:49.140550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:53:21.146267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:59:25.151717 3.002935 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:59:32.160026 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:59:40.160854 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:59:56.164060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:00:28.170299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:03:02.825032 0.000058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:03:02.825141 0.117344 tcp 10.0.2.112 49464 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:03:02.969738 0.108766 tcp 10.0.2.112 49465 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:06:32.176464 3.001690 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:06:39.183797 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:06:47.185182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:07:03.188205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:07:35.193939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:13:39.201282 3.000917 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:13:46.207795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:13:54.209537 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:14:10.212448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:14:42.218753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:20:46.224500 3.000961 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:20:53.231944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:21:01.233773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:21:17.236225 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:21:49.242453 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:27:53.248758 3.000897 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:28:00.255749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:28:08.257474 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:28:24.260459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:28:56.265965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:33:02.833630 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:33:02.833757 0.116781 tcp 10.0.2.112 49466 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:33:02.974792 0.117079 tcp 10.0.2.112 49467 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:35:00.272837 3.001147 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:35:07.280700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:35:15.281262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:35:31.284259 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:36:03.290038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:42:07.296686 3.000703 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:42:14.303767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:42:22.307430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:42:38.308325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:43:10.314282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:49:16.322330 3.002401 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:49:23.330612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:49:31.331955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:49:47.334620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:50:19.341018 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:56:23.347911 3.000759 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:56:30.354537 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:56:38.356169 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:56:54.358869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:57:26.365395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:03:02.841771 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:03:02.841906 0.117499 tcp 10.0.2.112 49468 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 09:03:02.985011 0.117384 tcp 10.0.2.112 49469 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 09:03:30.371769 3.000873 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:03:37.378666 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:03:45.380063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:04:01.383070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:04:33.388813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:10:37.394952 3.001830 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:10:44.403727 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:10:52.404137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:11:08.407273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:11:40.413000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:17:44.418982 3.001066 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:17:51.426323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:17:59.427521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:18:15.430779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:18:47.436803 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:24:51.442672 3.002004 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:24:58.450039 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:25:06.451952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:25:22.455027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:25:54.460655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:31:58.466766 3.001705 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:32:05.474436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:32:13.475728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:32:29.478517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:33:01.485440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:33:02.849264 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:33:02.849361 0.108690 tcp 10.0.2.112 49470 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 09:33:02.984523 0.115264 tcp 10.0.2.112 49471 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 09:39:05.490788 3.001669 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:39:12.498209 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:39:20.499627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:39:36.502708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:40:08.508938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:46:16.520751 3.001552 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:46:23.527920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:46:31.529748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:46:47.532359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:47:19.538478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:53:23.544644 3.002020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:53:30.552151 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:53:38.553561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:53:54.556512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:54:26.562318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:00:30.569911 3.000276 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:00:37.575978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:00:45.577804 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:01:01.583618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:01:33.586739 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:03:02.856832 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:03:02.856988 0.115073 tcp 10.0.2.112 49472 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:03:02.997275 0.116941 tcp 10.0.2.112 49473 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:07:37.593343 3.000604 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:07:44.600052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:07:52.601965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:08:08.604287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:08:40.610466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:14:44.616217 3.001836 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:14:51.624195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:14:59.625286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:15:15.628341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:15:47.634566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:23:07.650672 3.000634 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:23:14.656800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:23:22.658661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:23:38.661809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:24:10.667627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:30:39.681053 2.999776 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:30:46.687367 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:30:54.688538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:31:10.691060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:31:42.697324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:33:02.865484 0.000087 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:33:02.865695 0.117490 tcp 10.0.2.112 49474 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:33:03.007169 0.108386 tcp 10.0.2.112 49475 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:37:46.703711 3.001527 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:37:53.711337 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:38:01.712486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:38:17.715692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:38:49.721347 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:44:57.733786 3.001043 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:45:04.740834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:45:12.742168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:45:28.745289 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:46:00.750916 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:52:07.761155 3.002205 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:52:14.768797 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:52:22.770549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:52:38.773682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:53:10.779496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:59:14.785946 3.001146 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:59:21.793084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:59:29.794653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:59:45.797455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:00:17.803737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:03:02.872748 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:03:02.873075 0.117158 tcp 10.0.2.112 49476 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:03:03.015075 0.108475 tcp 10.0.2.112 49477 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:03:08.703949 0.010074 udp 10.0.2.112 57410 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 11:03:08.714677 0.118762 tcp 10.0.2.112 49478 -> 37.19.5.65 80 FSPA* 0 0 13 5568 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:06:21.810217 3.001204 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:06:28.816838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:06:36.818422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:06:52.821386 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:07:24.827742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:13:28.833756 3.001513 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:13:35.841281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:13:43.842514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:13:59.845247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:14:31.851770 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:20:35.858156 3.000992 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:20:42.864867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:20:50.866575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:21:06.869317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:21:38.875723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:27:42.881672 3.002162 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:27:49.888993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:27:57.890385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:28:13.893499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:28:45.903066 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:33:02.881530 0.000076 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:33:02.881694 0.117429 tcp 10.0.2.112 49479 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:33:03.028059 0.106305 tcp 10.0.2.112 49480 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:34:49.905466 3.002071 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:34:56.912761 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:35:04.914159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:35:20.917218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:35:52.923422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:41:56.929838 3.001224 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:42:03.936733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:42:11.938180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:42:27.941227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:42:59.950107 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:49:05.957494 3.000078 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:49:12.977365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:49:20.964994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:49:36.968109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:50:08.974022 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:56:12.980650 3.001010 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:56:19.987712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:56:27.988937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:56:43.992125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:57:15.998105 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:03:02.889165 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:03:02.889316 0.105893 tcp 10.0.2.112 49481 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:03:03.028054 0.117294 tcp 10.0.2.112 49482 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:03:20.005636 3.000004 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:03:27.011724 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:03:35.012955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:03:51.016331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:04:23.022068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:10:27.028995 3.000622 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:10:34.035630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:10:42.036926 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:10:58.040211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:11:30.045820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:17:34.051255 3.002673 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:17:41.059040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:17:49.060859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:18:05.063997 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:18:37.070019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:24:41.076752 3.001416 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:24:48.083758 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:24:56.085059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:25:12.087676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:25:44.093289 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:31:48.103674 3.001950 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:31:55.107498 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:32:03.108987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:32:19.111856 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:32:51.117851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:33:02.897203 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:33:02.897301 0.116902 tcp 10.0.2.112 49483 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:33:03.042336 0.115076 tcp 10.0.2.112 49484 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:38:55.124556 3.001192 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:39:02.131259 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:39:10.132695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:39:26.135917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:39:58.141905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:46:05.151916 3.001958 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:46:12.161230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:46:20.161192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:46:36.165371 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:47:08.170219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:53:12.176022 3.001803 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:53:19.183602 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:53:27.186321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:53:43.188256 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:54:15.194131 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:00:19.201594 3.000291 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:00:26.215218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:00:34.209174 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:00:50.212322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:01:22.217511 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:03:01.946910 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:03:01.947068 0.010187 udp 10.0.2.112 57918 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/03 13:03:01.957902 0.161243 tcp 10.0.2.112 49485 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:02.904573 0.010052 udp 10.0.2.112 52251 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/03 13:03:02.915270 0.108500 tcp 10.0.2.112 49486 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:03.048350 0.106193 tcp 10.0.2.112 49487 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:03.086785 0.115455 tcp 10.0.2.112 49488 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:32.118187 0.000191 tcp 10.0.2.112 49485 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:36.811416 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:07:26.224966 3.000320 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/03 13:07:33.230933 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:07:41.232807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:07:57.237214 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:08:29.243321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:14:33.248116 3.001727 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:14:40.255499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:14:48.256782 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:15:04.269377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:15:36.276049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:22:57.281925 3.002299 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:23:04.290252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:23:12.291669 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:23:28.294556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:24:00.300848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:30:28.315682 2.997038 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:30:35.319731 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:30:43.322495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:30:59.323198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:31:31.329238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:33:02.912871 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:33:02.912986 0.115296 tcp 10.0.2.112 49489 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:33:03.028390 0.000037 tcp 10.0.2.112 49485 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 13:33:03.056122 0.115017 tcp 10.0.2.112 49490 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:37:35.335250 3.012085 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:37:42.352840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:37:50.354158 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:38:06.357343 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:38:38.363215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:44:47.376567 3.001440 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:44:54.383839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:45:02.384983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:45:18.387966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:45:50.394411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:51:58.406410 3.001253 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:52:05.413346 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:52:13.415425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:52:29.418290 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:53:01.424188 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:59:05.429758 3.001969 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:59:12.437152 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:59:20.438965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:59:36.441942 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:00:08.448208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:03:02.920715 0.000108 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:03:02.920914 0.115428 tcp 10.0.2.112 49491 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:03:03.060793 0.117437 tcp 10.0.2.112 49492 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:06:12.454020 3.001748 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:06:19.461390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:06:27.462840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:06:43.466425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:07:15.471938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:13:19.479124 3.000758 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:13:26.485424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:13:34.487342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:13:50.490228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:14:22.496250 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:20:26.503282 3.000386 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:20:33.509162 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:20:41.510921 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:20:57.513916 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:21:29.520064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:27:33.526337 3.001269 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:27:40.533695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:27:48.534717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:28:04.538021 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:28:36.543992 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:33:02.929828 0.000078 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:33:02.930017 0.114781 tcp 10.0.2.112 49493 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:33:03.069447 0.105780 tcp 10.0.2.112 49494 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:34:40.550110 3.001287 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:34:47.557596 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:34:55.558653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:35:11.561865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:35:43.568183 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:41:47.573900 3.001774 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:41:54.581457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:42:02.583817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:42:18.586133 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:42:50.591978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:48:55.599487 3.001758 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:49:02.606759 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:49:10.608459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:49:26.610558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:49:58.617530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:56:02.623278 3.001476 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:56:09.630660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:56:17.632254 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:56:33.635387 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:57:05.641288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:03:02.937724 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:03:02.938133 0.115484 tcp 10.0.2.112 49495 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:03:03.079304 0.114642 tcp 10.0.2.112 49496 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:03:08.707767 0.057472 udp 10.0.2.112 59129 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 15:03:08.765908 0.109728 tcp 10.0.2.112 49497 -> 37.19.5.65 80 FSPA* 0 0 13 5625 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:03:09.648141 3.000561 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:03:16.654688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:03:24.656194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:03:40.659349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:04:12.665320 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:10:16.672796 2.999872 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:10:23.678483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:10:31.680541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:10:47.683275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:11:19.689361 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:17:23.696210 3.000799 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:17:30.702603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:17:38.704585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:17:54.707666 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:18:26.713227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:24:34.727431 2.998950 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:24:41.732321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:24:49.734075 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:25:05.736776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:25:37.742628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:31:41.749663 3.000950 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:31:48.756493 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:31:56.757920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:32:12.760622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:32:44.766896 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:33:02.944914 0.000084 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:33:02.945083 0.117070 tcp 10.0.2.112 49498 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:33:03.085912 0.108603 tcp 10.0.2.112 49499 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:38:48.773821 3.000904 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:38:55.780178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:39:03.781816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:39:19.784853 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:39:51.790459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:45:55.797746 3.003524 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:46:02.804265 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:46:10.805491 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:46:26.808893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:46:58.814837 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:53:02.822293 3.000008 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:53:09.831735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:53:17.829896 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:53:33.832736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:54:05.838741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:00:09.844533 3.001854 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:00:16.852206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:00:24.853692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:00:40.856553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:01:12.872823 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:03:02.953063 0.000092 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:03:02.953240 0.114648 tcp 10.0.2.112 49500 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:03:03.092408 0.117670 tcp 10.0.2.112 49501 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:07:16.879550 3.001917 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:07:23.887462 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:07:31.887917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:07:47.890709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:08:19.896665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:14:23.904275 2.999867 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:14:30.910535 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:14:38.911630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:14:54.914572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:15:26.920450 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:21:30.926756 3.003631 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:21:37.937705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:21:45.935701 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:22:01.938741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:22:33.944614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:28:37.950702 3.001331 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:28:44.958031 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:28:52.960122 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:29:08.962591 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:29:40.970934 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:33:02.960812 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:33:02.960959 0.108183 tcp 10.0.2.112 49502 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:33:03.095184 0.115021 tcp 10.0.2.112 49503 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:35:44.974451 3.001718 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:35:51.982193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:35:59.983508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:36:15.986654 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:36:47.992538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:42:56.004670 3.001168 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:43:03.011615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:43:11.013002 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:43:27.016498 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:43:59.022224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:50:03.028329 3.001504 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:50:10.035594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:50:18.037168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:50:34.040174 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:51:06.045931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:57:10.052806 3.001177 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:57:17.059652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:57:25.060889 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:57:41.063918 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:58:13.070323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:03:02.972484 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:03:02.972691 0.117638 tcp 10.0.2.112 49504 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:03:03.122437 0.117508 tcp 10.0.2.112 49505 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:04:17.077361 3.000563 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:04:24.084131 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:04:32.085267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:04:48.090845 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:05:20.094154 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:11:24.101724 2.999804 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:11:31.107617 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:11:39.109118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:11:55.115395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:12:27.117843 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:18:31.124305 3.001480 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:18:38.131788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:18:46.133284 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:19:02.135936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:19:34.142047 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:25:38.149687 2.999943 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:25:45.155514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:25:53.156964 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:26:09.159772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:26:41.166331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:32:45.172145 3.001549 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:32:52.179328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:33:00.180936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:33:02.976857 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:33:02.977099 0.106274 tcp 10.0.2.112 49506 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:33:03.107706 0.108004 tcp 10.0.2.112 49507 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:33:16.183832 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:33:48.190084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:39:52.196522 3.001080 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:39:59.203477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:40:07.205542 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:40:23.208032 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:40:55.216832 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:46:59.221417 3.000399 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:47:06.226799 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:47:14.228651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:47:30.231236 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:48:02.237964 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:54:06.244252 3.001429 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:54:13.251297 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:54:21.252795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:54:37.256032 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:55:09.261820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:01:13.270503 2.998350 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:01:20.275432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:01:28.276812 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:01:44.279936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:02:16.285728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:03:02.984981 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:03:02.985369 0.117811 tcp 10.0.2.112 49508 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:03:03.134514 0.114446 tcp 10.0.2.112 49509 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:08:20.292316 3.001273 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:08:27.299342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:08:35.300377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:08:51.303675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:09:23.309869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:15:27.315355 3.002035 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:15:34.323464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:15:42.324635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:15:58.327699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:16:30.333628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:23:33.344631 3.001723 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:23:40.351420 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:23:48.353436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:24:04.356966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:24:36.362529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:01.369109 3.001311 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:31:08.376357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:16.377648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:32.380691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:32:04.386676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:33:02.998021 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:33:02.998142 0.115171 tcp 10.0.2.112 49510 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:33:03.137641 0.115764 tcp 10.0.2.112 49511 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:38:08.393253 3.000878 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:38:15.400128 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:38:23.401787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:38:39.404673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:39:11.410592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:45:15.417457 3.000848 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:45:22.424126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:45:30.425536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:45:46.428800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:46:18.434518 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:52:22.441364 3.001127 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:52:29.448418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:52:37.449613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:52:53.452649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:53:25.458694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:59:29.464662 3.001617 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:59:36.472147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:59:44.473571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:00:00.476679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:00:32.482446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:03:03.002488 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:03:03.002600 0.106449 tcp 10.0.2.112 49512 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:03:03.139247 0.106286 tcp 10.0.2.112 49513 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:03:08.712041 0.009838 udp 10.0.2.112 63873 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 19:03:08.722627 0.115969 tcp 10.0.2.112 49514 -> 37.19.5.65 80 FSPA* 0 0 13 5615 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:06:36.489063 3.001113 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:06:43.496172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:06:51.497438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:07:07.500352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:07:39.506523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:13:43.512435 3.001747 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:13:50.520176 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:13:58.521400 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:14:14.524340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:14:46.530394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:20:50.536550 3.001605 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:20:57.543912 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:05.553572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:21.548528 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:53.554715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:27:57.560502 3.001462 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:28:04.568105 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:28:12.569493 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:28:28.572693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:29:00.578559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:33:03.009348 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:33:03.009534 0.115061 tcp 10.0.2.112 49515 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:33:03.151210 0.117214 tcp 10.0.2.112 49516 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:35:04.585609 3.000621 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:35:11.591961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:35:19.598335 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:35:35.596623 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:36:07.602662 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:42:11.608798 3.002713 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:42:18.615696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:42:26.617159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:42:42.620217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:43:14.626586 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:49:18.632920 3.001030 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:49:25.639658 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:49:33.640648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:49:49.644297 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:50:21.650397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:56:25.656887 3.001115 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:56:32.663824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:56:40.665849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:56:56.668299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:57:28.674163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:03:03.017088 0.000056 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:03:03.017202 0.117152 tcp 10.0.2.112 49517 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:03:03.158063 0.108234 tcp 10.0.2.112 49518 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:03:32.680964 3.000982 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:03:39.688020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:03:47.689071 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:04:03.692024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:04:35.698140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:08:02.600395 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:08:02.600557 0.009946 udp 10.0.2.112 55881 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 20:08:02.611142 0.131724 tcp 10.0.2.112 49519 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:10:39.704268 3.001949 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:10:46.711383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:10:54.713341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:11:10.716644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:11:42.722124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:17:46.728665 3.001329 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:17:53.735785 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:18:01.737328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:18:17.740312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:18:49.746134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:24:53.753596 3.000239 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:25:00.759941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:08.761741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:24.764029 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:56.770301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:00.776314 3.001629 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:32:07.783575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:15.785398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:31.788081 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:33:03.025298 0.000094 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:33:03.025481 0.116994 tcp 10.0.2.112 49520 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:33:03.173809 0.106237 tcp 10.0.2.112 49521 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:33:03.794273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:39:07.800975 3.000970 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:39:14.807646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:39:22.809024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:39:38.812076 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:40:10.818204 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:46:14.826803 2.998816 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:46:21.831437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:46:29.832803 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:46:45.836514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:47:17.841898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:53:21.848442 3.001758 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:53:28.855566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:53:36.857011 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:53:52.860190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:54:24.866167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:00:28.872377 3.001737 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:00:35.880317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:00:43.881653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:00:59.884000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:01:31.891955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:03:03.033438 0.000058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:03:03.033552 0.106024 tcp 10.0.2.112 49522 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:03.168075 0.116890 tcp 10.0.2.112 49523 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:07:35.897251 3.000419 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:07:42.903321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:07:50.904870 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:08:06.908195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:08:38.913883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:14:42.920590 3.001340 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:14:49.927544 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:14:57.929091 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:15:13.932092 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:15:45.938205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:23:06.944526 3.001718 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:23:13.952144 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:23:21.953510 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:23:37.956641 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:24:09.962541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:30:37.976344 2.998762 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:30:44.980632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:30:52.982464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:31:08.985960 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:31:40.990779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:33:03.041354 0.000137 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:33:03.041575 0.114939 tcp 10.0.2.112 49524 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:33:03.180181 0.117846 tcp 10.0.2.112 49525 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:37:45.998521 3.001827 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:37:53.006037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:38:01.007816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:38:17.010395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:38:49.016906 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:44:53.022677 3.001439 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:45:00.029970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:45:08.031446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:45:24.035635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:45:56.050234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:52:00.057666 3.000513 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:52:07.064254 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:52:15.065367 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:52:31.068400 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:53:03.074749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:59:07.081463 3.000826 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:59:14.087844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:59:22.089160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:59:38.092230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:00:10.098262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:03:03.049070 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:03:03.049177 0.117521 tcp 10.0.2.112 49526 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:03:03.191442 0.114870 tcp 10.0.2.112 49527 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:06:14.106582 3.000413 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:06:21.111702 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:06:29.113070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:06:45.116535 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:07:17.122477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:13:21.127891 3.002037 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:13:28.135766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:13:36.137393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:13:52.140387 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:14:24.146323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:20:28.151591 3.002459 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:20:35.159927 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:20:43.161269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:20:59.164229 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:21:31.170336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:27:35.176524 3.000926 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:27:42.183634 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:27:50.185215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:28:06.188113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:28:38.194299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:33:03.057503 0.000102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:33:03.057699 0.115118 tcp 10.0.2.112 49528 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:33:03.196327 0.108188 tcp 10.0.2.112 49529 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:34:42.200286 3.001435 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:34:49.207512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:34:57.209023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:35:13.212167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:35:45.218459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:41:49.223863 3.001863 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:41:56.231688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:42:04.233165 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:42:20.235546 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:42:52.242275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:48:56.249230 3.000666 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:49:03.255736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:49:11.257192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:49:27.260249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:49:59.265969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:56:03.271823 3.001613 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:56:10.279386 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:56:18.280981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:56:34.284078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:57:06.290209 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:03:01.947727 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:03:01.947844 0.009639 udp 10.0.2.112 57234 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/03 23:03:01.958199 0.176351 tcp 10.0.2.112 49530 -> 37.19.5.22 80 SPA_* 0 0 27 17520 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:03.064844 0.010140 udp 10.0.2.112 61584 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/03 23:03:03.075558 0.118451 tcp 10.0.2.112 49531 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:03.223590 0.116130 tcp 10.0.2.112 49532 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:03.233479 0.011208 udp 10.0.2.112 63064 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/03 23:03:03.245333 0.116938 tcp 10.0.2.112 49533 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:08.715586 0.010010 udp 10.0.2.112 56278 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/03 23:03:08.726168 0.430263 tcp 10.0.2.112 49534 -> 37.19.5.65 80 FSPA* 0 0 15 5826 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:10.296892 3.000889 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:03:17.303104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:03:25.305315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:03:32.133467 0.000151 tcp 10.0.2.112 49530 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:03:36.811657 0.000182 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:03:41.308137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:04:13.315822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:10:17.323487 2.997959 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:10:24.331309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:10:32.328671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:10:48.331931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:11:20.337786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:17:24.344271 3.001450 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:17:31.351042 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:17:39.355732 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:17:55.355951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:18:27.361622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:24:31.368622 3.000930 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:24:38.375359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:24:46.376647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:25:02.379995 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:25:34.385830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:31:38.391769 3.001937 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:31:45.399212 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:31:53.400898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:32:09.403965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:32:41.409895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:33:03.072874 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:33:03.073031 0.117318 tcp 10.0.2.112 49535 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:33:03.190495 0.000060 tcp 10.0.2.112 49530 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 23:33:03.216513 0.114840 tcp 10.0.2.112 49536 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:38:45.415925 3.002035 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:38:52.423355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:39:00.424203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:39:16.429982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:39:48.434105 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:45:52.441420 2.999982 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:45:59.447572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:46:07.448945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:46:23.451928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:46:55.458611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:52:59.463504 3.002042 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:53:06.471330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:53:14.472592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:53:30.475811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:54:02.481554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:00:06.487987 3.001453 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:00:13.495397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:00:21.496912 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:00:37.499803 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:01:09.505863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:03:03.081412 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:03:03.081572 0.117317 tcp 10.0.2.112 49537 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:03:03.222900 0.117364 tcp 10.0.2.112 49538 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:07:13.512528 3.011746 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:07:20.528822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:07:28.533744 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:07:44.534564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:08:16.539456 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:14:20.546254 3.000956 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:14:27.553296 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:14:35.554675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:14:51.557899 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:15:23.563676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:21:27.570007 3.001368 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:21:34.577315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:21:42.578923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:21:58.581601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:22:30.588140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:28:34.594072 3.001295 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:28:41.600777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:28:49.602483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:29:05.605752 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:29:37.611587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:33:03.089131 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:33:03.089315 0.117316 tcp 10.0.2.112 49539 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:33:03.237435 0.115366 tcp 10.0.2.112 49540 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:35:41.619012 3.000191 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:35:48.625339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:35:56.626635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:36:12.629749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:36:44.635804 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:42:48.641994 3.001636 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:42:55.649213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:43:03.651885 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:43:19.653438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:43:51.659648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:49:55.666350 3.001213 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:50:02.674282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:50:10.674647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:50:26.677401 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:50:58.683625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:57:02.689859 3.000986 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:57:09.697433 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:57:17.698309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:57:33.701742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:58:05.707438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:03:03.097545 0.000043 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:03:03.097682 0.106123 tcp 10.0.2.112 49541 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:03:03.228311 0.106145 tcp 10.0.2.112 49542 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:04:09.713284 3.002285 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:04:16.721055 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:04:24.722443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:04:40.725235 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:05:12.731649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:11:16.737348 3.002283 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:11:23.745338 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:11:31.748798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:11:47.749357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:12:19.755430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:18:23.761690 3.001227 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:18:30.768929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:18:38.770620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:18:54.775972 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:19:26.779496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:25:30.785966 3.001531 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:25:37.792701 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:25:45.794637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:26:01.797435 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:26:33.803364 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:32:37.809578 3.002020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:32:44.817187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:32:52.818353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:33:03.105189 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:33:03.105302 0.117729 tcp 10.0.2.112 49543 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:33:03.249191 0.117755 tcp 10.0.2.112 49544 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:33:08.821328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:33:40.827472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:39:44.833648 3.001596 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:39:51.840891 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:39:59.842159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:40:15.845511 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:40:47.851219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:46:51.857323 3.001692 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:46:58.870198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:47:06.866299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:47:22.872123 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:47:54.875956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:53:58.883074 3.000127 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:54:05.888568 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:54:13.890260 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:54:29.893112 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:55:01.899545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:01:05.905820 3.001501 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:01:12.912345 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:01:20.914098 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:01:36.917555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:02:08.923308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:03:03.113539 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:03:03.113697 0.106046 tcp 10.0.2.112 49545 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:03:03.243608 0.114888 tcp 10.0.2.112 49546 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:08:12.930003 3.000722 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:08:19.936651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:08:27.938191 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:08:43.941622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:09:15.947656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:15:19.953737 3.001497 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:15:26.960484 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:15:34.961970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:15:50.965391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:16:22.971524 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:23:31.980722 3.001568 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:23:38.990219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:23:46.989864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:24:02.992375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:24:34.998619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:31:02.008576 3.001028 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:31:09.015473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:31:17.016483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:31:33.019907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:32:05.025553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:33:03.121771 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:33:03.121873 0.114974 tcp 10.0.2.112 49547 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:33:03.260458 0.115042 tcp 10.0.2.112 49548 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:38:09.031878 3.001464 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:38:16.039346 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:38:24.040607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:38:40.043543 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:39:12.049663 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:45:16.056238 3.001110 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:45:23.062835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:45:31.064550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:45:47.067342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:46:19.073803 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:52:23.080427 3.003219 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:52:30.086932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:52:38.088521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:52:54.091193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:53:26.099763 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:59:30.104429 3.004182 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:59:37.110733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:59:45.114716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:00:01.115450 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:00:33.506949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:03:03.130058 0.000064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:03:03.130183 0.117537 tcp 10.0.2.112 49549 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:03:03.275076 0.117147 tcp 10.0.2.112 49550 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:03:08.720942 0.010015 udp 10.0.2.112 55706 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 03:03:08.731671 0.116185 tcp 10.0.2.112 49551 -> 37.19.5.65 80 FSPA* 0 0 13 5731 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:06:37.157354 3.002118 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:06:44.164758 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:06:52.166293 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:07:08.169383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:07:40.175661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:13:44.181900 3.001347 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:13:51.188877 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:13:59.190309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:14:15.193665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:14:47.199463 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:20:51.206724 3.000429 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:20:58.213033 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:21:06.219685 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:21:22.216938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:21:54.223552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:27:58.229593 3.003246 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:28:05.236299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:28:13.238375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:28:29.241262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:29:01.247066 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:33:03.139210 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:33:03.139358 0.108513 tcp 10.0.2.112 49552 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:33:03.271266 0.117810 tcp 10.0.2.112 49553 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:35:05.255475 2.999811 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:35:12.260287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:35:20.262279 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:35:36.265355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:36:08.271899 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:42:12.277851 3.001698 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:42:19.284980 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:42:27.286282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:42:43.289568 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:43:15.295406 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:49:19.302713 3.000622 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:49:26.308718 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:49:34.310222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:49:50.318390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:50:22.319427 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:56:26.329207 2.997855 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:56:33.332932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:56:41.333677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:56:57.337307 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:57:29.343215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:03:03.145478 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:03:03.145601 0.108730 tcp 10.0.2.112 49554 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:03:03.285302 0.108559 tcp 10.0.2.112 49555 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:03:33.349126 3.002435 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:03:40.356644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:03:48.358301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:04:04.361217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:04:36.367447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:10:40.373929 3.001175 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:10:47.380220 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:10:55.382041 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:11:11.385468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:11:43.391214 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:17:47.397027 3.002526 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:17:54.405043 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:18:02.406067 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:18:18.409695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:18:50.415549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:24:54.421561 3.001151 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:25:01.428692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:25:09.430195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:25:25.433050 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:25:57.438470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:32:01.445150 3.001601 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:32:08.456387 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:32:16.454085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:32:32.457717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:33:03.153282 0.000113 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:33:03.153493 0.108505 tcp 10.0.2.112 49556 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:33:03.286335 0.115258 tcp 10.0.2.112 49557 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:33:04.463512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:39:08.469958 3.000794 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:39:15.476514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:39:23.477807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:39:39.480987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:40:11.486768 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:46:15.494005 3.000632 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:46:22.500686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:46:30.502048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:46:46.505267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:47:18.511561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:53:22.517044 3.001760 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:53:29.524523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:53:37.525975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:53:53.528923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:54:25.534858 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:00:29.541444 3.001091 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:00:36.548626 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:00:44.549887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:01:00.555802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:01:32.559197 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:03:03.161452 0.000046 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:03:03.161549 0.108447 tcp 10.0.2.112 49558 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:03:03.298621 0.108661 tcp 10.0.2.112 49559 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:07:36.565835 3.000877 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:07:43.572301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:07:51.573976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:08:07.576931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:08:39.582547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:14:43.589772 3.005951 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:14:50.600692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:14:58.597646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:15:14.600595 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:15:46.606838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:23:06.623291 3.000326 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:23:13.629882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:23:21.631420 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:23:37.634086 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:24:09.640133 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:30:38.653124 3.000738 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:30:45.659765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:30:53.660895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:31:09.664038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:31:41.670079 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:33:03.169588 0.000090 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:33:03.169769 0.106507 tcp 10.0.2.112 49560 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:33:03.303716 0.117864 tcp 10.0.2.112 49561 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:37:45.677510 2.999948 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:37:52.683296 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:38:00.684874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:38:16.687810 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:38:48.694016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:44:52.700761 3.001206 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:44:59.707624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:45:07.711222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:45:23.711936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:45:55.717846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:51:59.723339 3.002408 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:52:06.731458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:52:14.732898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:52:30.735700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:53:02.742070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:59:06.752625 3.000912 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:59:13.755742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:59:21.756679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:59:37.759848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:00:09.766264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:03:03.178198 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:03:03.178349 0.115967 tcp 10.0.2.112 49562 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:03:03.320263 0.106191 tcp 10.0.2.112 49563 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:13.772204 3.001607 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:06:20.779503 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:06:28.780863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:06:44.783724 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:07:16.789989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:13:20.796270 3.001322 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:13:27.803605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:13:35.804683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:13:51.807688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:14:23.813788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:20:27.820304 3.001261 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:20:34.827369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:20:42.829087 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:20:58.831622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:21:30.837689 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:27:34.845476 3.000213 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:27:41.851388 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:27:49.852614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:28:05.855646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:28:37.861836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:33:03.185258 0.000045 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:33:03.185385 0.106253 tcp 10.0.2.112 49564 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:33:03.324764 0.114988 tcp 10.0.2.112 49565 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:34:41.868658 3.001421 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:34:48.875797 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:34:56.879038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:35:12.879943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:35:44.891780 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:41:48.892309 3.001174 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:41:55.899425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:42:03.900687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:42:19.903888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:42:51.909916 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:48:55.915307 3.002025 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:49:02.923412 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:49:10.928564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:49:26.931659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:49:58.933709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:56:02.941084 3.000380 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:56:09.947265 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:56:17.948372 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:56:33.951573 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:57:05.957876 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:03:03.196180 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:03:03.196298 0.115967 tcp 10.0.2.112 49566 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:03:03.338447 0.108807 tcp 10.0.2.112 49567 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:03:08.725093 0.009620 udp 10.0.2.112 49598 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 07:03:08.735822 0.118785 tcp 10.0.2.112 49568 -> 37.19.5.65 80 FSPA* 0 0 13 5711 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:03:09.963971 3.001604 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:03:16.970811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:03:24.972794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:03:40.975521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:04:12.981523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:10:16.987968 3.001358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:10:23.994953 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:10:32.000446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:10:47.999644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:11:20.899882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:17:24.021836 3.001668 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:17:31.028927 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:17:39.030385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:17:55.033987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:18:27.039821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:24:33.049588 3.000147 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:24:40.055861 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:24:48.057583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:25:04.060312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:25:36.066206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:31:40.073008 3.001698 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:31:47.079616 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:31:55.081343 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:32:11.084275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:32:43.090211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:33:03.201469 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:33:03.201657 0.108727 tcp 10.0.2.112 49569 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:33:03.335476 0.117258 tcp 10.0.2.112 49570 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:38:47.099949 2.997866 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:38:54.103898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:39:02.105630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:39:18.108250 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:39:50.114538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:45:54.123108 3.005414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:46:01.127646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:46:09.128810 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:46:25.132341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:46:57.138508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:53:01.143483 3.002546 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:53:08.151753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:53:16.153451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:53:32.156257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:54:04.162199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:00:08.169723 3.002237 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:00:15.175681 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:00:23.177369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:00:39.180195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:01:11.186136 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:03:03.210227 0.000116 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:03:03.210444 0.115320 tcp 10.0.2.112 49571 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:03:03.351261 0.117511 tcp 10.0.2.112 49572 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:07:15.192996 3.000898 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:07:22.199506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:07:30.200966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:07:46.204192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:08:18.209988 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:14:22.217168 3.000824 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:14:29.223599 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:14:37.225521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:14:53.227445 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:15:25.234084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:21:29.239438 3.002318 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:21:36.248238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:21:44.249280 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:22:00.252063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:22:32.258162 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:28:36.263368 3.002195 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:28:43.271413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:28:51.272820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:29:07.275958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:29:39.282242 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:33:03.217430 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:33:03.217589 0.115210 tcp 10.0.2.112 49573 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:33:03.364404 0.117539 tcp 10.0.2.112 49574 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:35:43.288506 3.001260 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:35:50.295636 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:35:58.296864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:36:14.299967 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:36:46.305971 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:42:50.311790 3.002304 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:42:57.319665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:43:05.320982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:43:21.323903 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:43:53.330073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:49:57.337512 3.000253 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:50:04.343762 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:50:12.344891 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:50:28.349704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:51:00.354219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:57:04.360583 3.001112 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:57:11.367195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:57:19.369325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:57:35.371237 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:58:07.377843 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:03:01.947883 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:03:01.948120 0.010238 udp 10.0.2.112 64710 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/04 09:03:01.959110 0.173453 tcp 10.0.2.112 49575 -> 37.19.5.22 80 SPA_* 0 0 27 17520 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:03:03.225646 0.009951 udp 10.0.2.112 62485 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/04 09:03:03.236092 0.115012 tcp 10.0.2.112 49576 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:03:03.378582 0.218426 tcp 10.0.2.112 49577 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:03:03.596671 0.117752 tcp 10.0.2.112 49578 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:03:32.131015 0.000160 tcp 10.0.2.112 49575 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:03:36.801855 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:04:11.384266 3.001662 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/04 09:04:18.391309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:04:26.392577 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:04:42.396096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:05:14.401943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:11:18.409223 3.000522 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:11:25.415340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:11:33.417015 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:11:49.419586 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:12:21.425833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:18:25.437684 2.996075 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:18:32.439130 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:18:40.440659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:18:56.443711 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:19:28.449924 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:25:32.456488 3.001027 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:25:39.463353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:25:47.464772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:26:03.467660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:26:35.473922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:32:39.480598 3.000750 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:32:46.487114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:32:54.488748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:33:03.236707 0.000056 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:33:03.236818 0.106244 tcp 10.0.2.112 49579 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:33:03.343227 0.000051 tcp 10.0.2.112 49575 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/04 09:33:03.366722 0.106009 tcp 10.0.2.112 49580 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:33:10.491280 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:33:42.497871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:39:46.505264 3.000296 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:39:53.511209 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:40:01.512888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:40:17.515757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:40:49.521671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:46:53.527526 3.001761 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:47:00.534899 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:47:08.536497 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:47:24.539599 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:47:56.545747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:54:00.551168 3.002897 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:54:07.559261 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:54:15.560561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:54:31.563715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:55:03.569711 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:01:07.577778 2.999594 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:01:14.582941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:01:22.584408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:01:38.587734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:02:10.593607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:03:03.241621 0.000114 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:03:03.241840 0.115364 tcp 10.0.2.112 49581 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:03:03.383729 0.117023 tcp 10.0.2.112 49582 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:08:14.600283 3.000456 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:08:21.607314 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:08:29.608678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:08:45.611563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:09:17.617843 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:15:21.623511 3.001755 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:15:28.630335 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:15:36.632652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:15:52.635263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:16:24.641558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:23:34.652150 3.001875 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:23:41.659709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:23:49.662748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:24:05.665864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:24:37.670422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:31:03.677946 3.005799 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:31:10.685659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:31:18.687021 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:31:34.689846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:32:06.696083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:33:03.249407 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:33:03.249585 0.117567 tcp 10.0.2.112 49583 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:33:03.395970 0.117029 tcp 10.0.2.112 49584 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:38:10.701497 3.002113 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:38:17.709559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:38:25.711448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:38:41.713919 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:39:13.720037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:45:17.726387 3.001184 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:45:24.733690 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:45:32.735204 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:45:48.738017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:46:20.744009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:52:24.750674 3.000882 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:52:31.757439 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:52:39.759778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:52:55.761975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:53:27.768058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:59:31.773352 3.002303 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:59:38.780693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:59:46.782664 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:00:02.786255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:00:34.791545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:03:03.257220 0.000068 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:03:03.257373 0.106716 tcp 10.0.2.112 49585 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:03:03.394295 0.108168 tcp 10.0.2.112 49586 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:03:08.729598 0.009614 udp 10.0.2.112 49724 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 11:03:08.740038 0.118815 tcp 10.0.2.112 49587 -> 37.19.5.65 80 FSPA* 0 0 13 5710 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:06:38.799067 3.000385 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:06:45.805517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:06:53.806833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:07:09.809839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:07:41.815766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:13:45.823086 3.000358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:13:52.829576 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:14:00.830346 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:14:16.834051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:14:48.839910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:20:52.848053 2.999755 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:20:59.853364 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:21:07.854937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:21:23.857699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:21:55.863728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:27:59.870382 3.001382 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:28:06.877246 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:28:14.879311 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:28:30.881868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:29:02.887871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:33:03.266196 0.000104 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:33:03.266408 0.115305 tcp 10.0.2.112 49588 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:33:03.411356 0.114693 tcp 10.0.2.112 49589 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:35:06.894527 3.000997 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:35:13.901058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:35:21.902865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:35:37.905744 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:36:09.911687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:42:13.917838 3.001743 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:42:20.925303 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:42:28.926565 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:42:44.929652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:43:16.937869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:49:20.942632 3.000852 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:49:27.953728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:49:35.950422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:49:51.953652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:50:23.959894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:56:27.965882 3.001364 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:56:34.972970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:56:42.974637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:56:58.977998 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:57:30.983780 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:03:03.273736 0.000058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:03:03.273853 0.106388 tcp 10.0.2.112 49590 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:03.405172 0.114787 tcp 10.0.2.112 49591 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:34.991057 3.001328 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:03:41.997479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:03:49.998750 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:04:06.001086 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:04:38.007362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:10:42.013114 3.002466 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:10:49.020966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:10:57.022456 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:11:13.025559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:11:45.030970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:17:49.039059 3.000440 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:17:56.045501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:18:04.046333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:18:20.049333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:18:52.055432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:24:56.061308 3.002043 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:25:03.069241 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:25:11.070240 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:25:27.074210 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:25:59.079230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:32:03.085721 3.001572 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:32:10.092615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:32:18.094392 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:32:34.097501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:33:03.281993 0.000100 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:33:03.282187 0.114612 tcp 10.0.2.112 49592 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:33:03.426140 0.106106 tcp 10.0.2.112 49593 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:33:06.103344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:39:10.112700 2.997858 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:39:17.116628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:39:25.120064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:39:41.121115 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:40:13.127561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:46:17.132890 3.002574 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:46:24.140874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:46:32.145514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:46:48.145321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:47:20.150830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:53:24.160395 2.998305 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:53:31.164668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:53:39.166026 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:53:55.169135 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:54:27.175441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:00:31.181067 3.001878 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:00:38.188835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:00:46.190282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:01:02.193472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:01:34.199905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:03:03.291076 0.132859 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:03:03.424177 0.115314 tcp 10.0.2.112 49594 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:03:03.565824 0.105879 tcp 10.0.2.112 49595 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:07:38.205518 3.001701 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:07:45.214798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:07:53.224061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:08:09.227405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:08:41.243786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:14:45.249510 3.001216 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:14:52.256609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:15:00.257971 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:15:16.263325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:15:48.267410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:23:08.282508 3.001641 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:23:15.290063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:23:23.293523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:23:39.294401 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:24:11.300367 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:30:40.311624 3.002438 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:30:47.320027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:30:55.322160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:31:11.324447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:31:43.330460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:33:03.298009 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:33:03.298130 0.108207 tcp 10.0.2.112 49596 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:33:03.438065 0.117452 tcp 10.0.2.112 49597 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:37:47.336872 3.001476 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:37:54.343668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:38:02.345538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:38:18.348290 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:38:50.354320 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:44:54.366782 2.995316 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:45:01.367864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:45:09.368882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:45:25.372252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:45:57.378285 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:01.388761 2.996742 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:52:08.391653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:16.393478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:32.396656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:53:04.402205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:08.408255 3.001670 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:59:15.415827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:23.416735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:39.420320 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:00:11.426588 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:03:03.306025 0.000079 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:03:03.306159 0.117568 tcp 10.0.2.112 49598 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:03:03.447920 0.114814 tcp 10.0.2.112 49599 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:06:15.433711 3.000328 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:06:22.439628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:06:30.441281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:06:46.443624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:07:18.450396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:13:22.457069 3.000820 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:13:29.463465 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:13:37.466193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:13:53.468413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:14:25.474234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:20:29.480585 3.001440 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:20:36.487485 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:20:44.488530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:21:00.492189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:21:32.498317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:27:36.504909 3.000792 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:27:43.512427 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:27:51.513267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:28:07.516049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:28:39.521976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:33:03.314282 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:33:03.314435 0.117301 tcp 10.0.2.112 49600 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:33:03.455542 0.114778 tcp 10.0.2.112 49601 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:34:43.528225 3.001410 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:34:50.534990 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:34:58.536839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:35:14.540247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:35:46.546223 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:41:50.551528 3.002185 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:41:57.559301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:42:05.561236 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:42:21.564188 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:42:53.570106 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:48:57.577577 3.000099 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:49:04.583478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:49:12.584991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:49:28.587875 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:50:00.594178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:04.600763 3.000895 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:56:11.607218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:19.609104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:35.611864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:57:07.618027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:03.321740 0.000093 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:03:03.321938 0.108402 tcp 10.0.2.112 49602 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:03:03.454866 0.117656 tcp 10.0.2.112 49603 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:03:08.732590 0.009541 udp 10.0.2.112 55559 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 15:03:08.742792 0.109424 tcp 10.0.2.112 49604 -> 37.19.5.65 80 FSPA* 0 0 13 5643 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:03:11.624440 3.001494 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:03:18.631671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:26.648064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:42.646185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:04:14.651961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:10:18.659411 3.000151 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:10:25.665352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:10:33.666945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:10:49.669983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:11:21.675825 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:17:25.682014 3.001626 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:17:32.689599 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:17:40.691124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:17:56.693858 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:18:28.699963 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:24:35.711071 3.000850 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:24:42.717739 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:24:50.719151 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:25:06.722056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:25:38.728253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:31:42.741029 2.996290 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:31:49.741716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:31:57.744883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:32:13.746121 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:32:45.752152 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:33:03.329676 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:33:03.329788 0.114675 tcp 10.0.2.112 49605 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:33:03.468083 0.116701 tcp 10.0.2.112 49606 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:38:49.758545 3.001549 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:38:56.765612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:39:04.767469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:39:20.770260 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:39:52.776332 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:45:56.792445 3.001385 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:46:03.801422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:11.801378 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:27.805007 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:59.810339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:03.816799 3.001069 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:53:10.823712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:18.825056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:34.827917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:54:06.834082 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:10.840642 3.001170 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:00:17.847949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:25.849274 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:41.852037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:01:13.859677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:03:03.337880 0.000052 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:03:03.338006 0.117429 tcp 10.0.2.112 49607 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:03:03.479848 0.116837 tcp 10.0.2.112 49608 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:07:17.864364 3.001917 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:07:24.871878 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:07:32.872819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:07:48.876017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:08:20.884585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:14:24.888450 3.001247 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:14:31.895788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:14:39.897218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:14:55.900027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:15:27.908627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:21:31.913405 3.000697 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:21:38.919710 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:21:46.923642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:22:02.923742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:22:34.929947 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:28:38.935581 3.002630 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:28:45.943839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:28:53.944867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:29:09.947977 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:29:41.954031 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:33:03.345982 0.000080 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:33:03.346177 0.117154 tcp 10.0.2.112 49609 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:33:03.487826 0.117811 tcp 10.0.2.112 49610 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:35:45.961049 3.005001 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:35:52.967637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:00.975434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:16.971877 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:48.978021 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:42:52.983946 3.007642 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:42:59.991606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:43:07.992890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:43:23.995676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:43:56.001915 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:00.008798 3.001471 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:50:07.015298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:15.016478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:31.020487 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:51:03.026521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:07.032533 3.001138 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:57:14.039240 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:22.040851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:38.043867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:58:10.049643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:03:03.357281 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:03:03.357424 0.115032 tcp 10.0.2.112 49611 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:03:03.510014 0.115802 tcp 10.0.2.112 49612 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:04:14.056599 3.000414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:04:21.063610 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:04:29.065107 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:04:45.070016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:05:17.073912 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:11:21.084224 2.996786 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:11:28.087564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:11:36.088423 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:11:52.091593 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:12:24.097733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:18:28.104534 3.000919 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:18:35.111223 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:18:43.112814 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:18:59.115782 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:19:31.121354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:25:35.127152 3.002154 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:25:42.134844 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:25:50.139945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:26:06.139657 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:26:38.145513 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:32:42.151297 3.002008 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:32:49.159822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:32:57.160615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:33:03.362272 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:33:03.362402 0.108303 tcp 10.0.2.112 49613 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:33:03.500540 0.117435 tcp 10.0.2.112 49614 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:33:13.164051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:33:45.168993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:39:49.176420 3.000760 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:39:56.183298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:40:04.184637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:40:20.187372 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:40:52.193523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:46:56.198928 3.001971 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:47:03.207180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:11.208615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:27.211595 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:59.217869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:03.224177 3.001218 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:54:10.230653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:18.232350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:34.238216 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:55:06.240904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:10.248266 3.002164 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:01:17.254864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:25.255799 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:41.259687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:02:13.265645 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:03:03.370783 0.000283 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:03:03.371165 0.114680 tcp 10.0.2.112 49615 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:03:03.510555 0.117395 tcp 10.0.2.112 49616 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:08:17.271416 3.001540 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:08:24.278742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:08:32.280157 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:08:48.283413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:09:20.288732 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:15:24.295385 3.001599 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:15:31.302863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:15:39.304077 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:15:55.307550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:16:27.313457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:23:30.325157 3.000874 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:23:37.331621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:23:45.333299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:24:01.336267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:24:33.342059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:30:37.348525 3.001400 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:30:44.355757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:30:52.357453 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:31:08.360143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:31:40.366031 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:33:03.379761 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:33:03.379937 0.117299 tcp 10.0.2.112 49617 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:33:03.521178 0.115180 tcp 10.0.2.112 49618 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:37:44.372878 3.001121 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:37:51.379238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:37:59.380904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:38:15.384117 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:38:47.390013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:44:51.397281 3.000281 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:44:58.403668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:45:06.404678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:45:22.407746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:45:54.418174 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:51:58.420013 3.001441 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:52:05.427563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:52:13.428513 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:52:29.431650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:53:01.438111 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:59:05.443999 3.001702 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:59:12.450998 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:59:20.453650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:59:36.456085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:00:08.462141 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:03:01.947891 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:03:01.948040 0.010018 udp 10.0.2.112 53423 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/04 19:03:01.958789 0.253217 tcp 10.0.2.112 49619 -> 37.19.5.22 80 SPA_* 0 0 24 17358 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:03.449378 0.009933 udp 10.0.2.112 64094 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/04 19:03:03.459874 0.117144 tcp 10.0.2.112 49620 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:03.602072 0.114849 tcp 10.0.2.112 49621 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:03.769040 0.115074 tcp 10.0.2.112 49622 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:08.767246 0.010215 udp 10.0.2.112 58269 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 19:03:08.778467 0.116674 tcp 10.0.2.112 49623 -> 37.19.5.65 80 FSPA* 0 0 13 5653 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:32.136195 0.000177 tcp 10.0.2.112 49619 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:03:36.801392 0.000073 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:06:12.467538 3.002263 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/04 19:06:19.475620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:06:27.481943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:06:43.479525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:07:15.485922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:13:19.492251 3.001603 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:13:26.499352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:13:34.501016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:13:50.503846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:14:22.509864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:20:26.516448 3.001263 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:20:33.523483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:20:41.524649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:20:57.527793 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:21:29.534000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:27:33.540924 3.001102 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:27:40.547647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:27:48.548747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:28:04.555649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:28:36.558000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:33:03.393901 0.000041 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:33:03.394009 0.108182 tcp 10.0.2.112 49624 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:33:03.502373 0.000064 tcp 10.0.2.112 49619 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/04 19:33:03.533081 0.108685 tcp 10.0.2.112 49625 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:34:40.565145 3.000559 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:34:47.570874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:34:55.572747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:35:11.575891 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:35:43.581988 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:41:47.588175 3.001417 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:41:54.595315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:42:02.596637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:42:18.599628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:42:50.605986 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:48:54.612052 3.001465 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:49:01.619555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:49:09.620716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:49:25.623941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:49:57.629916 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:56:01.637102 3.000434 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:56:08.643355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:56:16.644913 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:56:32.647540 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:57:04.654133 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:03:03.401396 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:03:03.401573 0.109794 tcp 10.0.2.112 49626 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:03:03.536149 0.117239 tcp 10.0.2.112 49627 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:03:08.660117 3.001772 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:03:15.666911 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:03:23.668688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:03:39.671772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:04:11.677710 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:08:03.124428 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:08:03.124583 0.010283 udp 10.0.2.112 64385 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 20:08:03.135481 0.132451 tcp 10.0.2.112 49628 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:10:15.684086 3.001463 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:10:22.691051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:10:30.697738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:10:46.695976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:11:18.701569 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:17:22.707942 3.001369 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:17:29.715103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:17:37.716581 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:17:53.719506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:18:25.725520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:24:31.734514 3.001641 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:24:38.742152 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:24:46.743455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:25:02.746445 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:25:34.752526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:31:38.760357 3.002964 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:31:45.765982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:31:53.767292 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:32:09.770318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:32:41.776318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:33:03.409634 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:33:03.409751 0.108365 tcp 10.0.2.112 49629 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:33:03.544322 0.115053 tcp 10.0.2.112 49630 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:38:45.783076 3.001152 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:38:52.790084 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:39:00.791549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:39:16.794412 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:39:48.800292 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:45:52.807374 3.000600 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:45:59.813795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:46:07.815365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:46:23.818520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:46:55.824319 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:52:59.830777 3.001136 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:53:06.837862 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:53:14.839539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:53:30.842323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:54:02.848442 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:00:06.857175 2.999147 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:00:13.862283 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:00:21.863689 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:00:37.867485 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:01:09.872249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:03:03.418246 0.000342 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:03:03.418729 0.106243 tcp 10.0.2.112 49631 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:03:03.549566 0.114833 tcp 10.0.2.112 49632 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:07:13.877836 3.002020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:07:20.885667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:07:28.887403 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:07:44.891068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:08:17.330255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:14:20.911633 3.002365 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:14:27.919773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:14:35.920766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:14:51.924290 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:15:23.930245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:21:27.936577 3.001389 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:21:34.943642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:21:42.945384 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:21:58.948301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:22:30.954182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:28:34.960367 3.001370 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:28:41.967448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:28:49.969344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:29:05.972130 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:29:38.119140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:33:03.425960 0.000084 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:33:03.426126 0.115089 tcp 10.0.2.112 49633 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:33:03.566382 0.117500 tcp 10.0.2.112 49634 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:35:41.994170 3.001555 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:35:49.001078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:35:57.002957 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:36:13.006088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:36:45.012120 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:42:49.019492 3.000312 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:42:56.025967 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:43:04.027330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:43:20.029970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:43:52.035777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:49:56.042335 3.001321 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:50:03.049441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:50:11.050800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:50:27.053818 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:50:59.060522 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:57:03.066613 3.001218 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:57:10.073474 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:57:18.074860 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:57:34.078006 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:58:06.084097 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:03:04.200665 0.000056 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:03:04.200811 0.114879 tcp 10.0.2.112 49635 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:03:04.349296 0.115250 tcp 10.0.2.112 49636 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:04:10.190309 3.001590 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:04:17.197670 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:04:25.199139 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:04:41.202153 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:05:13.208028 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:11:20.302396 2.971266 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:11:27.222625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:11:35.129257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:11:51.002143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:12:22.627042 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:18:27.958500 2.961024 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:18:34.872211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:18:42.762566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:18:58.541253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:19:30.096805 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:25:31.855634 2.998892 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:25:38.860360 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:25:46.861669 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:26:02.865408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:26:34.870747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:32:38.877250 3.001185 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:32:45.884380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:32:53.885965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:33:03.878731 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:33:03.878901 0.115133 tcp 10.0.2.112 49637 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:33:04.022383 0.106194 tcp 10.0.2.112 49638 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:33:09.888696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:33:41.895475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:39:47.905242 3.000301 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:39:54.911920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:40:02.915410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:40:18.915661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:40:50.921877 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:46:54.929096 3.000390 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:47:01.935620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:47:09.936418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:47:25.939670 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:47:57.946086 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:54:01.952705 3.000721 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:54:08.959257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:54:16.960608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:54:32.963526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:55:04.969698 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:01:08.975897 3.001742 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:01:15.983202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:01:23.984641 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:01:39.987650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:02:11.993458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:03:03.870613 0.000078 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:03:03.870772 0.108576 tcp 10.0.2.112 49639 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:03:04.004161 0.105874 tcp 10.0.2.112 49640 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:03:14.532693 0.009788 udp 10.0.2.112 59938 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/04 23:03:14.683400 0.315083 tcp 10.0.2.112 49641 -> 37.19.5.65 80 FSPA* 0 0 13 5662 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:08:16.000325 3.001096 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:08:23.006757 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:08:31.008383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:08:47.011435 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:09:19.017464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:15:23.022913 3.002436 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:15:30.030573 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:15:38.032617 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:15:54.035441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:16:26.041321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:22:30.047778 3.001238 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:22:37.055259 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:22:45.056523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:23:01.061700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:23:33.065538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:29:37.072391 3.004377 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:29:44.078815 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:29:52.080352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:30:08.083679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:30:40.089377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:33:03.878496 0.000099 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:33:03.878676 0.117396 tcp 10.0.2.112 49642 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:33:04.027075 0.108534 tcp 10.0.2.112 49643 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:36:44.095840 3.001673 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:36:51.102846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:36:59.104328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:37:15.107375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:37:47.113554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:43:51.120463 3.000583 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:43:58.127145 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:44:06.128168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:44:22.131499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:44:54.137225 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:50:58.143229 3.001665 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:51:05.150672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:51:13.152344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:51:29.157617 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:52:01.161418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:58:05.167855 3.001133 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:58:12.174780 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:58:20.175717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:58:36.178767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:59:08.185424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:03:03.886567 0.000049 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:03:03.886680 0.117255 tcp 10.0.2.112 49644 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:03:04.028974 0.106485 tcp 10.0.2.112 49645 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:05:12.191032 3.002103 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:05:19.198402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:05:27.199820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:05:43.203536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:06:15.210295 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:12:19.215062 3.002020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:12:26.222824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:12:34.224528 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:12:50.227380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:13:22.233485 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:19:26.244243 3.008369 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:19:33.256280 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:19:41.258191 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:19:57.261331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:20:29.267362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:26:33.272987 3.002096 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:26:40.280521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:26:48.282600 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:27:04.285839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:27:36.290722 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:33:03.894449 0.000348 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:33:03.894910 0.117468 tcp 10.0.2.112 49646 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:33:04.043574 0.114540 tcp 10.0.2.112 49647 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:33:40.298507 3.000440 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:33:47.304549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:33:55.306180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:34:11.308536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:34:43.325359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:40:47.331816 3.000978 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:40:54.338302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:41:02.339849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:41:18.343635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:41:50.349246 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:47:54.354743 3.001607 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:48:01.362532 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:48:09.364208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:48:25.367121 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:48:57.373090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:55:01.379646 3.001138 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:55:08.385958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:55:16.388161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:55:32.391455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:56:04.397064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:02:08.403238 3.002446 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:02:15.409961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:02:23.411998 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:02:39.415348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:03:03.916784 0.000338 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:03:03.917254 0.118851 tcp 10.0.2.112 49648 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:03:04.063487 0.117599 tcp 10.0.2.112 49649 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:03:11.420393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:09:15.426882 3.001954 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:09:22.434452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:09:30.435860 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:09:46.439179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:10:18.444946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:16:22.451102 3.001709 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:16:29.457987 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:16:37.459986 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:16:53.463294 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:17:25.468975 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:23:29.475474 3.001295 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:23:36.482435 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:23:44.484065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:24:00.486791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:24:32.493661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:30:36.499558 3.001010 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:30:43.506352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:30:51.507965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:31:07.510614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:31:39.517003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:33:03.920918 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:33:03.921123 0.106214 tcp 10.0.2.112 49650 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:33:04.051207 0.117836 tcp 10.0.2.112 49651 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:37:43.523394 3.001211 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:37:50.530245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:37:58.531957 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:38:14.534851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:38:46.540820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:44:50.547787 3.000473 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:44:57.554109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:45:05.555873 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:45:21.559007 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:45:53.564729 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:51:57.571287 3.001224 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:52:04.578189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:52:12.579918 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:52:28.582881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:53:00.588846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:59:04.596209 3.000334 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:59:11.602248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:59:19.603676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:59:35.606706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:00:07.612946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:03:03.928586 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:03:03.928693 0.115774 tcp 10.0.2.112 49652 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:03:04.068806 0.108472 tcp 10.0.2.112 49653 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:06:11.619421 3.001509 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:06:18.626214 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:06:26.627656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:06:42.630704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:07:14.636704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:13:18.643595 3.000716 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:13:25.650154 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:13:33.651676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:13:49.654663 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:14:21.660827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:20:25.667552 3.000769 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:20:32.675362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:20:40.675571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:20:56.678733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:21:28.684657 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:27:32.691095 3.000990 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:27:39.698085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:27:47.699598 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:28:03.702563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:28:35.708950 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:33:03.936841 0.000114 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:33:03.937046 0.117477 tcp 10.0.2.112 49654 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:33:04.084868 0.109196 tcp 10.0.2.112 49655 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:34:39.714661 3.001793 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:34:46.721817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:34:54.723657 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:35:10.726502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:35:42.732590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:41:46.741325 2.999091 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:41:53.746063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:42:01.747510 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:42:17.750311 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:42:49.757598 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:48:53.763400 3.000634 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:49:00.769994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:49:08.771672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:49:24.774307 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:49:56.780365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:56:00.787236 3.000887 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:56:07.793835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:56:15.801709 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:56:31.798552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:57:03.804376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:03:04.244247 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:03:04.244345 0.106346 tcp 10.0.2.112 49656 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:03:04.376941 0.115077 tcp 10.0.2.112 49657 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:03:07.811027 3.001073 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:03:11.717746 0.010810 udp 10.0.2.112 57610 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 03:03:11.729372 0.116676 tcp 10.0.2.112 49658 -> 37.19.5.65 80 FSPA* 0 0 13 5670 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:03:14.818194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:03:22.819440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:03:38.822321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:04:10.828439 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:10:14.833999 3.001888 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:10:21.841859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:10:29.843720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:10:45.846383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:11:17.852526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:17:21.859069 3.001073 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:17:28.866025 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:17:36.867373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:17:52.880523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:18:24.886521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:28.892380 3.001665 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:24:35.899840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:43.900863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:59.904172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:25:31.910579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:31:35.917114 3.000875 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:31:42.923663 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:31:50.925256 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:32:06.928475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:32:38.934650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:33:03.952468 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:33:03.952609 0.116985 tcp 10.0.2.112 49659 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:33:04.105949 0.115753 tcp 10.0.2.112 49660 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:38:42.942297 2.999755 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:38:49.947697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:38:57.949058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:39:13.952317 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:39:45.961603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:45:49.965369 3.000590 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:45:56.971733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:46:04.972948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:46:20.975991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:46:52.982091 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:52:56.988516 3.001441 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:53:03.995624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:53:11.997251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:53:28.000282 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:54:00.007600 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:00:04.011775 3.002058 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:00:11.019118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:00:19.020982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:00:35.024083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:01:07.030211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:03:03.961398 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:03:03.961565 0.108691 tcp 10.0.2.112 49661 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:03:04.097901 0.115108 tcp 10.0.2.112 49662 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:07:11.036576 3.001097 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:07:18.043446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:07:26.045444 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:07:42.048020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:08:14.054079 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:14:18.070757 3.001145 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:14:25.077413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:14:33.079295 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:14:49.082081 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:15:21.087996 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:25.094393 3.001668 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:21:32.101354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:40.103208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:56.112111 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:22:28.112166 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:28:32.117792 3.001596 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:28:39.125557 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:28:47.127046 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:29:03.129912 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:29:35.138333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:33:03.968302 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:33:03.968405 0.117519 tcp 10.0.2.112 49663 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:33:04.144631 0.106487 tcp 10.0.2.112 49664 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:35:39.142105 3.001455 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:35:46.148885 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:35:54.150781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:36:10.153976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:36:42.159776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:42:46.167625 2.999903 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:42:53.173286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:43:01.174863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:43:17.177927 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:43:49.183847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:49:53.190387 3.001244 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:50:00.197590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:50:08.198650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:50:24.201786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:50:56.208298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:57:00.214527 3.001360 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:57:07.220824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:57:15.222837 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:57:31.226073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:58:03.231329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:03:03.975115 0.007236 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:03:03.982558 0.117713 tcp 10.0.2.112 49665 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:03:04.123846 0.108750 tcp 10.0.2.112 49666 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:03:06.006465 0.010386 udp 10.0.2.112 52004 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/05 05:03:06.029847 1.571132 tcp 10.0.2.112 49667 -> 37.19.5.22 80 SPA_* 0 0 24 17358 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:03:10.563654 0.010140 udp 10.0.2.112 54942 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/05 05:03:10.583351 0.643240 tcp 10.0.2.112 49668 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:03:37.601033 0.000178 tcp 10.0.2.112 49667 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:03:42.219205 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:04:07.238772 3.292924 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/05 05:04:14.501589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:04:23.355115 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:04:39.163767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:05:10.785913 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:11:14.282335 3.001478 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:11:27.047182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:11:34.936477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:11:50.731783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:12:22.296007 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:18:21.316071 3.001955 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:18:28.323318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:18:36.328114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:18:52.327708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:19:24.334059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:28.349880 3.001608 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:25:35.357483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:43.358718 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:59.361831 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:26:31.367601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:32:35.373907 3.002281 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:32:42.381306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:32:50.382872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:33:03.984315 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:33:03.984485 0.108690 tcp 10.0.2.112 49669 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:33:04.093327 0.000034 tcp 10.0.2.112 49667 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/05 05:33:04.117503 0.117252 tcp 10.0.2.112 49670 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:33:06.385869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:33:38.401848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:39:42.407188 3.002388 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:39:49.415840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:39:57.416567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:40:13.419174 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:40:45.426081 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:46:49.431810 3.001423 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:46:56.439217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:47:04.440733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:47:20.443848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:47:52.449594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:53:56.455382 3.002187 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:54:03.463666 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:54:11.464779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:54:27.467785 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:54:59.473714 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:03.480187 3.001268 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:01:10.487371 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:18.491861 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:34.491736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:02:06.497661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:03:03.992690 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:03:03.993045 0.126668 tcp 10.0.2.112 49671 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:03:04.146760 0.109080 tcp 10.0.2.112 49672 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:08:10.504056 3.002637 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:08:17.511224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:08:25.512747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:08:41.515860 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:09:13.521430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:15:17.529024 3.000625 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:15:24.535454 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:15:32.536494 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:15:48.539556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:16:20.545864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:24.552122 3.004291 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:22:31.559181 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:39.560660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:55.563525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:23:27.569048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:29:31.575604 3.001669 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:29:38.583389 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:29:46.584330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:30:02.587477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:30:34.593692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:33:04.000305 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:33:04.000430 0.106493 tcp 10.0.2.112 49673 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:33:04.130535 0.117667 tcp 10.0.2.112 49674 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:36:38.600325 3.005209 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:36:45.607118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:36:53.608261 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:37:09.611428 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:37:43.160207 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:43:45.632862 3.002312 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:43:52.640862 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:44:00.642447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:44:16.645449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:44:48.651303 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:50:52.657259 3.001574 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:50:59.664949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:07.666322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:23.669391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:55.675340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:57:59.684286 2.998740 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:58:06.688842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:58:14.690288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:58:30.693616 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:59:04.399802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:03:04.008716 0.000104 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:03:04.008905 0.142506 tcp 10.0.2.112 49675 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:03:04.175805 0.109360 tcp 10.0.2.112 49676 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:03:11.673257 0.009776 udp 10.0.2.112 53272 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 07:03:11.683667 0.116336 tcp 10.0.2.112 49677 -> 37.19.5.65 80 FSPA* 0 0 13 5630 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:05:06.715641 3.001204 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:05:13.722772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:05:21.724357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:05:37.727402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:06:09.743578 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:12:13.750017 3.000696 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:12:20.756946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:12:28.758240 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:12:44.765362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:13:16.767874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:19:20.773442 3.001769 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:19:27.780905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:19:35.782359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:19:51.785307 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:20:23.791271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:26:27.796920 3.002097 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:26:34.804592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:26:42.806185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:26:58.809467 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:27:30.825580 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:33:04.016369 0.000047 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:33:04.016454 0.115349 tcp 10.0.2.112 49678 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:33:04.155499 0.117080 tcp 10.0.2.112 49679 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:33:34.831982 3.215765 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:33:42.017019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:33:49.945962 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:34:05.853383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:34:37.859434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:40:41.865067 3.005660 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:40:48.872865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:40:56.874254 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:41:12.877371 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:41:44.883471 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:47:48.889400 3.001199 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:47:55.896989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:48:03.898234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:48:19.901390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:48:51.907631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:54:55.913097 3.001842 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:55:02.920584 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:10.922139 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:26.925253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:58.933273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:02.937070 3.002049 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:02:09.944382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:17.946339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:33.951556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:03:04.025193 0.000044 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:03:04.025284 0.115491 tcp 10.0.2.112 49680 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:03:04.170067 0.106625 tcp 10.0.2.112 49681 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:03:05.955187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:09.961470 3.067083 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:09:17.010321 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:24.981570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:40.983088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:10:12.998787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:17.005894 3.000953 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:16:24.012605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:32.014194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:48.017530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:17:20.023373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:23:24.031499 2.999370 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:23:31.036351 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:23:39.037960 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:23:55.041199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:24:27.047113 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:30:31.052676 3.002166 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:30:38.060179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:30:46.061857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:31:02.065012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:31:34.070856 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:33:04.032218 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:33:04.032367 0.117420 tcp 10.0.2.112 49682 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:33:04.248405 0.114835 tcp 10.0.2.112 49683 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:37:38.076445 3.002126 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:37:45.084603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:37:53.085918 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:38:09.088585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:38:41.095117 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:44:45.100986 3.001626 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:44:52.111301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:00.111306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:16.115576 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:48.128971 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:51:52.134524 3.002054 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:51:59.142436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:07.143733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:23.147103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:55.152950 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:58:59.158812 3.001826 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:59:06.166328 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:59:14.167830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:59:30.170606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:00:02.176752 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:03:04.040220 0.000056 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:03:04.040323 0.117781 tcp 10.0.2.112 49684 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:03:04.181896 0.115038 tcp 10.0.2.112 49685 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:06:06.187510 2.997046 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:06:13.190213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:06:22.803929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:06:38.621370 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:07:10.245517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:13:13.226500 3.001864 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:13:20.234495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:13:28.236281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:13:44.238867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:14:16.244868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:20:20.250379 3.001973 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:20:27.258469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:20:35.259567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:20:51.262787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:21:23.268249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:27:27.274345 3.001546 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:27:34.282285 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:27:42.284319 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:27:58.287396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:28:30.293172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:33:04.049016 0.000045 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:33:04.049108 0.117201 tcp 10.0.2.112 49686 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:33:04.190389 0.117090 tcp 10.0.2.112 49687 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:34:34.298493 3.001825 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:34:41.306324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:34:49.307625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:35:05.310576 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:35:37.369038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:41:41.332260 3.002073 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:41:48.339753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:41:56.341727 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:42:12.344746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:42:44.350640 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:48:48.356269 3.002189 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:48:55.364094 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:03.365486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:19.368152 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:51.374735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:55:55.381964 3.000398 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:56:02.388115 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:10.389602 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:26.392529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:58.399611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:02.403782 3.002584 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:03:04.056456 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:03:04.056704 0.114919 tcp 10.0.2.112 49688 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:03:04.204658 0.106257 tcp 10.0.2.112 49689 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:03:09.411969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:17.413625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:33.416536 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:04:05.422597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:10:09.432222 2.998155 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:10:16.436287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:10:24.437543 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:10:40.440501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:11:12.446380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:17:16.452079 3.001981 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:17:23.460048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:17:31.461247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:17:47.464469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:18:19.469930 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:24:23.476611 3.001562 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:24:30.484362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:24:38.485830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:24:54.488769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:25:26.494460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:31:30.501150 3.000948 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:31:37.508081 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:31:45.509405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:32:01.512834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:32:33.518374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:33:04.064169 0.000043 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:33:04.064253 0.106244 tcp 10.0.2.112 49690 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:33:04.200770 0.116607 tcp 10.0.2.112 49691 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:38:37.524907 3.001144 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:38:44.531846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:38:52.533480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:39:08.538625 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:39:40.542651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:45:44.549397 3.000474 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:45:51.555644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:45:59.557473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:46:15.560539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:46:47.576163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:52:51.582919 3.011081 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:52:58.601358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:06.610394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:22.604446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:54.610458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:59:58.617529 3.000524 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:00:05.623785 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:00:13.625358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:00:29.628438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:01:01.634412 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:03:04.072233 0.050562 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:03:04.122904 0.115040 tcp 10.0.2.112 49692 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:03:04.265062 0.296016 tcp 10.0.2.112 49693 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:03:11.676267 0.226091 udp 10.0.2.112 56307 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 11:03:11.903269 0.110256 tcp 10.0.2.112 49694 -> 37.19.5.65 80 FSPA* 0 0 13 5648 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:07:05.640663 3.001447 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:07:12.648018 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:07:20.649486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:07:36.652430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:08:08.658447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:14:12.665451 3.000526 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:14:19.671794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:14:27.673389 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:14:43.676190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:15:15.682538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:21:19.688570 3.001467 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:21:26.695833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:21:34.697447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:21:50.700503 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:22:22.706264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:28:26.712879 3.001095 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:28:33.719658 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:28:41.720762 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:28:57.724257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:29:29.730302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:33:04.081084 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:33:04.081382 0.108228 tcp 10.0.2.112 49695 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:04.217771 0.115271 tcp 10.0.2.112 49696 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:35:33.735948 3.002039 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:35:40.743543 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:35:48.745019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:36:04.748227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:36:36.754248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:42:40.761090 3.000993 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:42:47.767569 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:42:55.769237 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:43:11.772382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:43:43.778125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:49:47.783951 3.002225 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:49:54.791734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:50:02.793274 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:50:18.795872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:50:50.801982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:56:54.808473 3.001478 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:57:01.815391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:57:09.816977 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:57:25.820214 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:57:57.826395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:03:04.089703 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:03:04.089830 0.114946 tcp 10.0.2.112 49697 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:03:04.229978 0.117756 tcp 10.0.2.112 49698 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:04:01.832775 3.001229 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:04:08.839655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:04:16.840876 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:04:32.843978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:05:04.851271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:11:08.857343 3.000278 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:11:15.863555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:11:23.865048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:11:42.608760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:12:14.216050 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:18:15.890122 3.001645 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:18:22.897512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:18:30.899040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:18:46.901827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:19:18.908163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:25:22.914537 3.001238 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:25:29.921507 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:25:37.922784 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:25:53.925843 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:26:25.931959 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:32:29.938311 3.001645 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:32:36.945925 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:32:44.956842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:33:00.960165 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:33:04.096520 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:33:04.096847 0.115382 tcp 10.0.2.112 49699 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:33:04.237524 0.450906 tcp 10.0.2.112 49700 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:33:32.966237 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:39:36.972512 3.001296 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:39:43.979544 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:39:51.980667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:40:07.983907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:40:39.990119 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:46:43.995710 3.001824 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:46:51.003184 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:46:59.008767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:47:15.009445 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:47:47.013939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:53:51.023514 2.998152 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:53:58.027358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:54:06.028689 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:54:22.031819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:54:54.037780 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:00:58.045496 3.000083 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:01:05.050705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:01:13.052224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:01:29.057261 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:02:01.061932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:03:04.104648 0.000056 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:03:04.104755 0.117741 tcp 10.0.2.112 49701 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:03:04.246192 0.114793 tcp 10.0.2.112 49702 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:05.067734 3.002142 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:08:12.113847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:08:20.086629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:08:36.089484 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:09:08.095751 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:15:12.101620 3.046854 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:15:19.128746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:15:27.120667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:15:43.123765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:16:15.129529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:22:19.135855 3.001575 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:22:26.143272 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:22:34.144819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:22:50.147716 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:23:22.153677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:29:26.160058 3.001284 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:29:33.167203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:29:41.168783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:29:57.171550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:30:29.177457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:33:04.112385 0.000046 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:33:04.112467 0.114817 tcp 10.0.2.112 49703 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:33:04.251671 0.114807 tcp 10.0.2.112 49704 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:36:33.183322 3.003964 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:36:40.190977 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:36:48.192528 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:37:04.195594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:37:37.670546 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:43:40.217667 3.001862 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:43:47.225547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:43:55.226508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:44:11.229632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:44:43.235930 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:50:47.241920 3.001452 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:50:54.249115 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:51:02.250379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:51:18.253508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:51:50.259085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:57:54.265877 3.001349 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:58:01.273075 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:58:09.274624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:58:25.767548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:58:57.391194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:03:04.120555 0.000110 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:03:04.120761 0.115021 tcp 10.0.2.112 49705 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:03:04.264576 0.114943 tcp 10.0.2.112 49706 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:05:01.301306 2.999541 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:05:08.307499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:05:16.309589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:05:32.311597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:06:04.317489 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:12:08.333148 3.002113 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:12:15.346372 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:12:23.342426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:12:39.345629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:13:11.351187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:19:15.357623 3.001678 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:19:22.364964 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:19:30.366772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:19:46.368897 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:20:18.375464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:26:22.382010 3.001238 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:26:29.388413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:26:37.390537 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:26:53.393562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:27:25.399268 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:33:04.129341 0.000090 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:33:04.129537 0.117302 tcp 10.0.2.112 49707 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:33:04.271060 0.114631 tcp 10.0.2.112 49708 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:33:29.405912 3.000760 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:33:36.413227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:33:44.417931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:34:00.417475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:34:32.427106 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:40:36.428773 3.002419 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:40:43.437078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:40:51.438036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:41:07.440901 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:41:39.447632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:47:43.453332 3.001916 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:47:50.460705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:47:58.462330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:48:14.465438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:48:46.471319 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:54:50.476895 3.002109 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:54:57.484958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:55:05.486413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:55:21.489584 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:55:53.497412 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:01:57.503482 2.999595 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:02:04.508605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:02:12.510273 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:02:28.513537 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:03:00.519188 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:03:02.376277 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:03:02.376483 0.010234 udp 10.0.2.112 51140 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/05 15:03:02.387376 0.174639 tcp 10.0.2.112 49709 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:04.135983 0.009942 udp 10.0.2.112 60269 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/05 15:03:04.146344 0.117515 tcp 10.0.2.112 49710 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:04.296573 0.108149 tcp 10.0.2.112 49711 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:11.682412 0.011046 udp 10.0.2.112 50251 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 15:03:11.694411 0.115981 tcp 10.0.2.112 49712 -> 37.19.5.65 80 FSPA* 0 0 13 5609 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:13.048059 0.117439 tcp 10.0.2.112 49713 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:32.560757 0.000170 tcp 10.0.2.112 49709 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:03:37.222189 0.000044 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:09:04.526222 3.001337 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:09:11.532893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:09:19.534469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:09:35.537404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:10:07.734085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:16:11.560556 3.000242 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:16:18.566661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:16:26.568228 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:16:42.574715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:17:14.577052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:23:18.583561 3.001365 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:23:25.590452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:23:33.592182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:23:49.595291 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:24:21.600656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:30:25.608764 3.000041 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:30:32.614598 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:30:40.616657 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:30:56.618956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:31:28.625568 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:33:04.322364 0.000090 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:33:04.322546 0.108399 tcp 10.0.2.112 49714 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:33:04.431140 0.000110 tcp 10.0.2.112 49709 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/05 15:33:04.454390 0.114786 tcp 10.0.2.112 49715 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:37:32.631106 3.001569 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:37:39.638601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:37:47.640802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:38:03.643213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:38:35.651845 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:44:39.655538 3.001124 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:44:46.662508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:44:54.664057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:45:10.669418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:45:42.673479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:51:46.680044 3.000715 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:51:53.686515 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:52:01.688175 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:52:17.690871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:52:49.698548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:58:53.703615 3.053579 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:59:00.735132 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:59:08.721924 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:59:24.744444 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:59:56.740719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:03:04.152750 0.000044 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:03:04.152850 0.116824 tcp 10.0.2.112 49716 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:03:04.295301 0.116662 tcp 10.0.2.112 49717 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:06:00.746723 3.002194 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:06:07.755345 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:06:15.756638 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:06:31.758725 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:07:03.765369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:13:07.772721 3.000103 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:13:14.778284 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:13:22.780039 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:13:38.783525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:14:11.022154 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:20:14.804925 3.001680 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:20:21.812457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:20:29.814070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:20:45.816871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:21:17.829544 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:27:21.830174 3.000526 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:27:28.836275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:27:36.837970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:27:52.840490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:28:24.846966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:33:04.160249 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:33:04.160397 0.108187 tcp 10.0.2.112 49718 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:33:04.298143 0.117659 tcp 10.0.2.112 49719 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:34:28.853655 3.000823 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:34:35.860480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:34:43.861696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:34:59.864706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:35:31.870689 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:41:35.876710 3.002063 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:41:42.884240 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:41:50.885978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:42:06.889864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:42:38.894836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:48:42.900997 3.001628 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:48:49.908334 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:48:57.909834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:49:13.912585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:49:45.919039 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:55:49.925377 3.001121 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:55:56.932253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:56:04.933863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:56:20.936734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:56:52.942665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:02:56.948267 3.003115 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:03:03.959864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:03:04.171494 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:03:04.171597 0.108338 tcp 10.0.2.112 49720 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:03:04.310857 0.105963 tcp 10.0.2.112 49721 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:03:11.957684 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:03:27.960636 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:03:59.966618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:10:03.973293 3.001232 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:10:10.980258 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:10:18.984551 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:10:34.986728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:11:06.997350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:17:10.997194 3.001098 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:17:18.003988 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:17:26.005838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:17:42.008481 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:18:14.024827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:24:18.031254 3.018868 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:24:25.047559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:24:33.049405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:24:49.079413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:25:21.078665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:31:25.085803 3.000477 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:31:32.093835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:31:40.093791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:31:56.096569 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:32:28.102529 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:33:04.177270 0.000060 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:33:04.177400 0.108569 tcp 10.0.2.112 49722 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:33:04.309693 0.106116 tcp 10.0.2.112 49723 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:38:32.109996 3.000384 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:38:39.116202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:38:47.117719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:39:03.120679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:39:35.126526 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:45:39.132689 3.001535 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:45:46.139825 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:45:54.141862 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:46:10.144561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:46:42.150779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:52:46.156388 3.001781 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:52:53.164042 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:53:01.165597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:53:17.168592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:53:49.174726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:59:53.180631 3.001496 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:00:00.191486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:00:08.188873 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:00:24.192554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:00:56.198354 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:03:04.184729 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:03:04.184817 0.117166 tcp 10.0.2.112 49724 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:03:04.325687 0.117583 tcp 10.0.2.112 49725 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:07:00.204411 3.001794 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:07:07.275348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:07:15.222926 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:07:31.226615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:08:03.232618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:14:07.238693 3.001513 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:14:14.245706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:14:22.247553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:14:38.250593 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:15:10.256555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:21:14.262242 3.009042 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:21:21.271204 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:21:29.270779 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:21:45.274301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:22:17.281063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:28:21.286687 3.002116 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:28:28.293900 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:28:36.295352 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:28:52.298336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:29:24.305076 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:33:04.192358 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:33:04.192662 0.118234 tcp 10.0.2.112 49726 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:33:04.339193 0.106053 tcp 10.0.2.112 49727 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:35:28.310700 3.001302 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:35:35.317667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:35:43.319421 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:35:59.322218 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:36:31.328530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:42:35.334338 3.001453 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:42:42.341359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:42:50.343388 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:43:06.346264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:43:38.352517 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:49:42.359137 3.000950 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:49:49.365710 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:49:57.367338 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:50:13.370269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:50:45.376601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:56:49.382964 3.000979 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:56:56.389609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:57:04.391264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:57:20.394134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:57:54.515692 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:03:04.200698 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:03:04.200943 0.175711 tcp 10.0.2.112 49728 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:03:04.407871 0.116956 tcp 10.0.2.112 49729 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:03:11.683875 0.048489 udp 10.0.2.112 49245 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 19:03:11.733078 0.118347 tcp 10.0.2.112 49730 -> 37.19.5.65 80 FSPA* 0 0 13 5595 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:03:56.416287 3.001750 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:04:03.423737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:04:11.427316 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:04:27.427882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:04:59.434272 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:11:03.440945 3.000762 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:11:10.447720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:11:18.449928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:11:34.452382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:12:06.458104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:18:10.464140 3.108943 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:18:17.542055 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:18:25.483611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:18:41.486398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:19:13.494380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:25:17.498641 3.526780 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:25:24.984919 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:25:32.890323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:25:48.690683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:26:20.526336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:32:24.533312 3.000647 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:32:31.539786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:32:39.540895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:32:55.544679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:33:04.208180 0.000107 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:33:04.208369 0.106342 tcp 10.0.2.112 49731 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:33:04.339627 0.114770 tcp 10.0.2.112 49732 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:33:27.550116 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:39:31.557035 3.000759 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:39:38.563699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:39:46.565414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:40:02.568234 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:40:34.574071 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:46:38.580414 3.001194 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:46:45.587542 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:46:53.588829 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:47:09.592048 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:47:41.598172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:53:45.604552 3.001016 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:53:52.611436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:54:00.613175 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:54:16.616060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:54:48.622220 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:00:52.628682 3.001048 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:00:59.635373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:01:07.636893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:01:23.640106 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:01:55.655978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:03:04.219678 0.000049 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:03:04.219780 0.116863 tcp 10.0.2.112 49733 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:03:04.362662 0.115553 tcp 10.0.2.112 49734 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:07:59.662269 3.001413 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:08:06.669629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:08:14.670956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:08:30.673766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:09:02.679897 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:15:06.686228 3.001243 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:15:13.693509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:15:21.695061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:15:37.698043 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:16:09.704077 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:22:13.709911 3.001918 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:22:20.717395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:22:28.718842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:22:44.721690 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:23:16.728023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:29:20.735235 3.000558 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:29:27.741248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:29:35.742920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:29:51.745970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:30:23.751741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:33:04.224640 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:33:04.224793 0.108106 tcp 10.0.2.112 49735 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:33:04.357092 0.116980 tcp 10.0.2.112 49736 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:36:27.961046 2.998868 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:36:34.965634 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:36:42.967367 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:36:58.975125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:37:30.976119 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:43:34.982097 3.001513 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:43:41.989495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:43:49.991375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:44:05.994319 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:44:37.999983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:50:42.009313 2.998738 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:50:49.013819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:50:57.015351 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:51:13.018151 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:51:45.024131 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:57:49.030206 3.001629 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:57:56.087243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:58:04.039363 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:58:20.042172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:58:52.047613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:03:04.232519 0.000051 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:03:04.232604 0.117869 tcp 10.0.2.112 49737 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:03:04.373961 0.106047 tcp 10.0.2.112 49738 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:04:56.054514 3.001101 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:05:03.061262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:05:11.073112 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:05:27.075922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:05:59.082024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:08:04.921046 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:08:04.921154 0.009944 udp 10.0.2.112 57480 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 21:08:04.931662 0.125236 tcp 10.0.2.112 49739 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:12:03.088357 3.001317 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:12:10.096464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:12:18.096794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:12:34.099962 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:13:06.106067 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:19:10.111801 3.002104 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:19:17.119037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:19:25.120922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:19:41.124182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:20:13.130023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:26:17.136454 3.001073 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:26:24.143952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:26:32.144778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:26:48.147632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:27:20.154316 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:33:04.240616 0.000082 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:33:04.240781 0.108421 tcp 10.0.2.112 49740 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:33:04.373882 0.116971 tcp 10.0.2.112 49741 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:33:24.160073 3.001220 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:33:31.167369 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:33:39.168895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:33:55.171881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:34:27.177928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:40:31.183696 3.119153 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:40:38.271065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:40:46.206088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:41:02.205642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:41:34.221951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:47:38.227387 3.002041 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:47:45.235718 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:47:53.236722 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:48:09.239961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:48:41.245993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:54:45.252043 3.001620 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:54:52.259584 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:55:00.339866 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:55:16.273723 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:55:48.280506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:01:52.286569 3.000792 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:01:59.293579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:02:07.667501 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:02:23.513485 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:02:55.313769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:03:04.250506 0.951869 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:03:05.202571 0.106381 tcp 10.0.2.112 49742 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:03:05.341588 0.106190 tcp 10.0.2.112 49743 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:08:59.319926 3.049128 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:09:06.437051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:09:14.371359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:09:30.351458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:10:02.357483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:16:06.363192 3.002871 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:16:13.371661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:16:21.372848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:16:37.375906 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:17:09.385816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:23:13.388132 3.001409 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:23:20.395309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:23:28.396939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:23:44.399414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:24:16.405587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:30:20.412050 3.001899 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:30:27.419269 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:30:35.420707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:30:51.423869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:31:23.429523 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:33:04.256562 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:33:04.256670 0.114967 tcp 10.0.2.112 49744 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:33:04.397385 0.117137 tcp 10.0.2.112 49745 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:37:27.436160 3.001003 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:37:34.442981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:37:42.444522 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:37:58.447695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:38:30.454103 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:44:34.460020 3.000793 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:44:41.466941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:44:49.468437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:45:05.471144 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:45:37.747509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:51:41.493878 3.001709 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:51:48.500607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:51:56.502670 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:52:12.505338 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:52:44.511552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:58:48.517788 3.001827 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:58:55.525260 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:59:03.526487 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:59:19.531587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:59:51.536079 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:03:04.264710 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:03:04.264893 0.117702 tcp 10.0.2.112 49746 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:03:04.408787 0.108537 tcp 10.0.2.112 49747 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:03:11.688017 0.009725 udp 10.0.2.112 52757 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/05 23:03:11.698468 0.107391 tcp 10.0.2.112 49748 -> 37.19.5.65 80 FSPA* 0 0 13 5590 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:05:55.541563 3.002145 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:06:02.548379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:06:10.550905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:06:26.553521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:06:58.559253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:13:02.565495 3.007977 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:13:09.573357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:13:17.574464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:13:33.577545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:14:05.583874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:20:09.589778 3.000918 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:20:16.596934 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:20:24.598834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:20:40.601488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:21:12.607508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:27:16.613195 3.002198 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:27:23.620580 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:27:31.622470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:27:47.625394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:28:19.631187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:33:04.275696 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:33:04.275855 0.106069 tcp 10.0.2.112 49749 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:33:04.409506 0.117484 tcp 10.0.2.112 49750 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:34:23.637157 3.002093 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:34:30.644868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:34:38.646206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:34:54.649521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:35:27.017696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:41:30.671245 3.001890 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:41:37.678770 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:41:45.680507 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:42:01.683459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:42:33.823962 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:48:37.707124 2.999805 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:48:44.712700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:48:52.714350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:49:08.717195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:49:40.723376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:55:44.729694 3.001126 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:55:51.736946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:55:59.738092 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:56:15.740823 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:56:47.747287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:02:51.753590 3.001608 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:02:58.760614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:03:04.280974 0.000121 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:03:04.281185 0.117495 tcp 10.0.2.112 49751 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:03:04.423185 0.117341 tcp 10.0.2.112 49752 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:03:06.762790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:03:22.765435 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:03:54.770700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:09:58.777492 3.001616 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:10:05.784776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:10:13.786143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:10:29.799430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:11:01.805505 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:17:05.810904 3.002170 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:17:12.818892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:17:20.820074 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:17:36.823153 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:18:08.829559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:24:12.834781 3.002241 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:24:19.844197 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:24:27.844109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:24:43.847377 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:25:15.853297 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:31:19.859195 3.001673 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:31:26.867606 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:31:34.868132 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:31:50.870830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:32:22.877348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:33:04.288806 0.000084 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:33:04.288979 0.115120 tcp 10.0.2.112 49753 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:33:04.427283 0.105841 tcp 10.0.2.112 49754 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:38:26.905813 3.515480 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:38:34.376251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:38:42.275949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:38:58.091156 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:39:29.931161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:45:33.937385 3.001637 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:45:40.944506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:45:48.946506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:46:04.949538 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:46:36.955380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:52:40.961265 3.001501 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:52:47.968287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:52:55.969980 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:53:11.973290 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:53:43.979366 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:59:47.985355 3.001378 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:59:54.992611 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:00:02.994214 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:00:18.996940 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:00:51.003137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:03:02.397263 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:03:02.397482 0.010943 udp 10.0.2.112 54204 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/06 01:03:02.409007 0.177638 tcp 10.0.2.112 49755 -> 37.19.5.22 80 SPA_* 0 0 27 17520 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:03:04.316202 0.012382 udp 10.0.2.112 56879 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/06 01:03:04.329024 0.214980 tcp 10.0.2.112 49756 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:03:04.569149 0.106546 tcp 10.0.2.112 49757 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:03:13.261215 0.010059 udp 10.0.2.112 54207 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/06 01:03:13.271914 0.108709 tcp 10.0.2.112 49758 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:03:32.585171 0.000267 tcp 10.0.2.112 49755 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:06:55.008952 3.001668 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/06 01:07:02.016410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:07:10.017990 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:07:26.020621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:07:58.027298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:14:02.033010 3.001599 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:14:09.040678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:14:17.041970 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:14:33.045099 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:15:05.050865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:21:09.057226 3.001328 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:21:16.067176 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:21:24.066026 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:21:40.069098 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:22:16.455379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:28:16.090672 3.001939 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:28:23.098172 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:28:31.099683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:28:47.102783 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:29:19.108980 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:33:04.325174 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:33:04.325313 0.106655 tcp 10.0.2.112 49759 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:33:04.432217 0.000054 tcp 10.0.2.112 49755 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 01:33:04.462535 0.106407 tcp 10.0.2.112 49760 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:35:23.115136 3.001156 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:35:30.122286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:35:38.123685 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:35:54.126769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:36:26.143495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:42:30.148624 3.001653 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:42:37.156336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:42:45.157664 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:43:01.160553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:43:33.330742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:49:37.182594 3.621914 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:49:44.757374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:49:52.656913 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:50:08.471499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:50:40.211157 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:56:44.216498 3.002066 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:56:51.224258 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:56:59.225434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:57:15.229097 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:57:47.234915 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:03:04.332825 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:03:04.333082 0.117509 tcp 10.0.2.112 49761 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:03:04.474551 0.115390 tcp 10.0.2.112 49762 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:03:51.241005 3.001306 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:03:58.248390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:04:06.249471 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:04:22.252700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:04:54.259002 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:10:58.264815 3.001520 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:11:05.272037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:11:13.273619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:11:29.276229 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:12:01.283132 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:18:05.289952 3.000645 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:18:12.296742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:18:20.297706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:18:36.301062 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:19:08.306888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:25:12.313399 3.001087 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:25:19.320250 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:25:27.321607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:25:43.324560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:26:15.330650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:32:19.340745 2.997658 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:32:26.344199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:32:34.345685 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:32:50.348705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:33:04.340549 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:33:04.340708 0.106750 tcp 10.0.2.112 49763 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:33:04.471000 0.114686 tcp 10.0.2.112 49764 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:33:22.355078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:39:26.370250 3.002097 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:39:33.377940 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:39:41.379582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:39:57.383923 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:40:29.388239 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:46:33.395250 3.000647 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:46:40.441686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:46:48.413597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:47:04.416608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:47:36.422688 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:53:40.429279 3.000977 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:53:47.436222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:53:55.437694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:54:11.440038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:54:43.446698 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:00:47.453157 3.001223 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:00:54.459911 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:01:02.461846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:01:18.465798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:01:50.470353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:03:04.348227 0.000080 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:03:04.348392 0.115219 tcp 10.0.2.112 49765 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:03:04.487072 0.115159 tcp 10.0.2.112 49766 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:03:11.712393 0.011189 udp 10.0.2.112 59515 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 03:03:11.724241 0.107229 tcp 10.0.2.112 49767 -> 37.19.5.65 80 FSPA* 0 0 13 5605 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:07:54.477206 3.001082 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:08:01.483882 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:08:09.485478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:08:25.488315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:08:57.494932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:15:01.500789 3.001414 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:15:08.508058 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:15:16.509490 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:15:32.512642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:16:04.518431 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:22:08.525580 3.000441 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:22:15.531890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:22:23.533794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:22:39.536545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:23:11.542547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:29:15.549295 3.000817 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:29:22.556036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:29:30.557310 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:29:46.560252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:30:18.569486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:33:04.356724 0.000045 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:33:04.356803 0.117453 tcp 10.0.2.112 49768 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:33:04.497852 0.115308 tcp 10.0.2.112 49769 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:36:22.573592 3.143558 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:36:29.689373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:36:37.624734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:36:53.594257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:37:25.600773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:43:29.605975 3.001988 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:43:36.613643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:43:44.615457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:44:00.618138 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:44:32.624319 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:50:36.631344 3.000799 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:50:43.638177 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:50:51.639499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:51:07.642380 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:51:39.650440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:57:43.654859 3.001309 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:57:50.661969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:57:58.663207 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:58:14.666463 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:58:46.672182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:03:04.364939 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:03:04.365034 0.106539 tcp 10.0.2.112 49770 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:03:04.495560 0.115008 tcp 10.0.2.112 49771 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:04:50.678145 3.008692 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:04:57.685655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:05:05.687683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:05:21.690482 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:05:53.697819 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:11:57.703161 3.001039 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:12:04.709976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:12:12.711063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:12:28.714644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:13:00.720639 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:19:04.726427 3.001579 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:19:11.733725 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:19:19.735842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:19:35.738365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:20:07.744629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:26:11.750971 3.000908 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:26:18.758162 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:26:26.760599 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:26:42.762112 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:27:14.768243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:33:04.372510 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:33:04.372606 0.117952 tcp 10.0.2.112 49772 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:33:04.514664 0.115200 tcp 10.0.2.112 49773 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:33:18.774383 3.001876 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:33:25.781976 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:33:33.783493 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:33:49.786652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:34:21.792124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:40:25.799555 3.000812 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:40:32.808173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:40:40.807390 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:40:56.810065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:41:28.816075 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:47:32.821963 3.001760 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:47:39.829816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:47:47.830687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:48:03.833822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:48:35.840302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:54:39.845854 3.001985 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:54:46.853541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:54:54.855788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:55:10.858293 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:55:42.864203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:01:46.871423 3.000226 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:01:53.877866 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:02:01.878774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:02:17.881928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:02:49.888137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:03:04.386306 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:03:04.386451 0.108830 tcp 10.0.2.112 49774 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:03:04.519339 0.115286 tcp 10.0.2.112 49775 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:08:53.894465 3.001456 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:09:00.901438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:09:08.902820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:09:24.906052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:09:56.911977 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:16:00.917769 3.002101 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:16:07.925401 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:16:15.926991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:16:31.929961 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:17:03.935926 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:23:07.942050 3.001666 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:23:14.949401 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:23:22.950812 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:23:38.953900 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:24:10.959756 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:30:14.968685 2.999020 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:30:21.973556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:30:29.974800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:30:45.978126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:31:17.983871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:33:04.388581 0.000071 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:33:04.388740 0.114814 tcp 10.0.2.112 49776 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:33:04.534483 0.115291 tcp 10.0.2.112 49777 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:37:21.989413 3.001923 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:37:28.997672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:37:36.998673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:37:53.001800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:38:25.007826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:44:29.014267 3.001492 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:44:36.021253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:44:44.022946 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:45:00.025738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:45:32.031604 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:51:50.166331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:52:22.638772 1.971849 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/06 05:52:50.529426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:52:58.432358 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:53:14.588089 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:53:46.196038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:59:49.226333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:59:56.109150 1.981059 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/06 06:00:02.038838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:00:09.927381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:00:25.726697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:00:57.282705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:04:12.819165 0.051936 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:04:12.871237 0.180353 tcp 10.0.2.112 49778 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:04:13.075437 0.202400 tcp 10.0.2.112 49779 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:06:58.006052 2.985464 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:07:05.774933 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:07:13.698636 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:07:29.482467 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:08:01.053085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:14:03.304181 3.002081 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:14:10.311867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:14:18.319515 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:14:34.316741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:15:06.322472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:21:10.328122 3.002149 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:21:17.336059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:21:25.336902 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:21:41.340645 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:22:13.346299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:28:17.352551 3.001519 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:28:24.359902 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:28:32.361425 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:28:48.364407 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:29:20.370385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:34:10.559497 0.000087 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:34:10.559670 0.117768 tcp 10.0.2.112 49780 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:34:10.701600 0.106136 tcp 10.0.2.112 49781 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:35:24.376498 3.001433 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:35:31.383357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:35:39.385410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:35:55.388318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:36:27.394452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:42:31.400882 3.001090 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:42:38.407942 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:42:46.409700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:43:02.412379 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:43:34.418397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:49:38.424431 3.001728 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:49:45.431293 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:49:53.433437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:50:09.436171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:50:41.442310 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:56:45.501962 2.977733 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:56:52.455618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:57:00.460091 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:57:16.460418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:57:48.466064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:03:52.472356 3.007508 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:03:59.497063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:04:07.481253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:04:10.568012 0.000082 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:04:10.568176 0.116857 tcp 10.0.2.112 49782 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:04:10.712983 0.106622 tcp 10.0.2.112 49783 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:04:17.870606 0.009734 udp 10.0.2.112 53613 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 07:04:17.881407 0.129434 tcp 10.0.2.112 49784 -> 37.19.5.65 80 FSPA* 0 0 13 5589 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:04:23.483902 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:04:55.490383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:10:59.496049 3.001960 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:11:06.504114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:11:14.505897 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:11:30.508170 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:12:02.514122 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:18:06.525144 2.998209 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:18:13.527893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:18:21.531427 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:18:37.532219 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:19:09.538299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:25:19.557211 2.997379 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:25:26.560173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:25:34.561648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:25:50.564765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:26:22.571222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:32:26.576775 3.002008 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:32:33.584016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:32:41.586416 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:32:57.588562 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:33:29.594251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:34:10.575980 0.000092 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:34:10.576169 0.117669 tcp 10.0.2.112 49785 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:34:10.718342 0.116973 tcp 10.0.2.112 49786 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:39:33.604202 2.998248 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:39:40.608093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:39:48.609973 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:40:04.612799 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:40:36.618712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:46:40.624705 3.001719 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:46:47.632090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:46:55.633744 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:47:11.637781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:47:43.642864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:53:47.650542 3.001320 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:53:54.656162 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:54:02.658257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:54:18.663915 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:54:50.670905 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:00:54.673969 3.000262 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:01:01.680382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:01:09.683509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:01:25.684473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:01:57.690821 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:04:10.584562 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:04:10.584735 0.114942 tcp 10.0.2.112 49787 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:04:10.723110 0.108513 tcp 10.0.2.112 49788 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:08:01.697901 3.001012 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:08:08.703985 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:08:16.705478 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:08:32.710788 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:09:04.716943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:15:08.720897 3.001411 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:15:15.728167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:15:23.729955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:15:39.732505 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:16:11.738509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:22:15.747158 2.999257 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:22:22.751991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:22:30.753667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:22:46.756373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:23:18.762344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:29:22.768523 3.001939 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:29:29.775789 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:29:37.778773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:29:53.781216 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:30:25.786545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:34:10.592020 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:34:10.592195 0.108235 tcp 10.0.2.112 49789 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:34:10.724546 0.108618 tcp 10.0.2.112 49790 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:36:29.793919 3.000357 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:36:36.801887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:36:44.801548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:37:00.807756 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:37:32.810499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:43:41.824666 3.000946 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:43:48.831239 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:43:56.832549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:44:12.836306 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:44:44.842036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:50:48.848889 3.000337 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:50:55.855022 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:51:03.856403 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:51:19.859533 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:51:51.865598 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:57:55.871789 3.001664 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:58:02.882271 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:58:10.880572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:58:26.883660 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:58:58.889937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:04:10.600159 0.000065 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:04:10.600274 0.117699 tcp 10.0.2.112 49791 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:04:10.749241 0.106167 tcp 10.0.2.112 49792 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:05:02.895282 3.002250 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:05:09.906717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:05:17.904601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:05:33.907665 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:06:05.913853 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:12:09.919589 3.001754 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:12:16.928806 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:12:24.928318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:12:40.931618 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:13:12.937879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:19:16.944042 3.001869 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:19:23.951083 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:19:31.952451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:19:47.955662 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:20:19.961418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:26:23.967534 3.002176 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:26:30.977775 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:26:38.976288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:26:54.979907 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:27:26.987628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:33:30.992072 3.000858 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:33:37.999074 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:33:46.000410 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:34:02.003481 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:34:10.607714 0.000085 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:34:10.607886 0.105953 tcp 10.0.2.112 49793 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:34:10.737400 0.117342 tcp 10.0.2.112 49794 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:34:34.009637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:40:41.020149 3.001400 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:40:48.026933 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:40:56.028549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:41:12.031717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:41:44.037630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:47:48.044517 3.000898 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:47:55.050910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:48:03.052651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:48:19.055721 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:48:51.061691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:54:55.069376 3.000435 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:55:02.075161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:55:10.078832 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:55:26.079838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:55:58.086937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:02:02.092076 3.001078 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:02:09.099364 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:02:17.101359 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:02:33.103509 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:03:05.110036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:04:10.615691 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:04:10.615792 0.108617 tcp 10.0.2.112 49795 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:04:10.747982 0.117178 tcp 10.0.2.112 49796 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:09:09.118760 2.999160 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:09:16.123009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:09:24.124774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:09:40.127627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:10:12.133768 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:16:16.141052 3.000169 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:16:23.147309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:16:31.148572 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:16:47.151469 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:17:19.157671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:24:22.168440 3.001631 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:24:29.176433 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:24:37.177629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:24:53.180869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:25:25.189963 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:31:50.191971 3.003196 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:31:57.200376 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:32:05.201455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:32:21.204462 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:32:53.210480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:34:10.624196 0.000089 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:34:10.624374 0.117660 tcp 10.0.2.112 49797 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:34:10.765064 0.115494 tcp 10.0.2.112 49798 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:38:57.217628 3.002500 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:39:04.224064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:39:12.225353 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:39:28.228424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:40:00.234411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:46:04.240543 3.001675 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:46:11.247948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:46:19.249659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:46:35.252325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:47:07.258533 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:53:11.264538 3.001226 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:53:18.272017 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:53:26.273446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:53:42.276344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:54:14.282345 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:00:18.288592 3.002518 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:00:25.295694 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:00:33.297881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:00:49.300928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:01:21.306330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:04:08.550653 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:04:08.550801 0.023404 udp 10.0.2.112 50218 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/06 11:04:08.574753 0.186222 tcp 10.0.2.112 49799 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:04:10.631662 0.025505 udp 10.0.2.112 56260 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/06 11:04:10.657639 0.115491 tcp 10.0.2.112 49800 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:04:10.796102 0.114629 tcp 10.0.2.112 49801 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:04:17.878427 0.025415 udp 10.0.2.112 53915 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 11:04:17.904555 0.118228 tcp 10.0.2.112 49802 -> 37.19.5.65 80 FSPA* 0 0 13 5615 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:04:19.550228 0.108343 tcp 10.0.2.112 49803 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:04:38.748711 0.000166 tcp 10.0.2.112 49799 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:07:25.312525 3.001602 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/06 11:07:32.319110 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:07:40.321440 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:07:56.323914 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:08:28.330154 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:14:32.336111 3.001912 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:14:39.343549 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:14:47.345216 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:15:03.348461 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:15:35.355610 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:21:39.360658 3.001395 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:21:46.367726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:21:54.369262 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:22:10.372695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:22:42.378338 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:28:46.384474 3.001741 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:28:53.391614 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:29:01.393018 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:29:17.395566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:29:49.402283 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:34:10.640424 0.000113 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:34:10.640642 0.115522 tcp 10.0.2.112 49804 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:34:10.756340 0.000031 tcp 10.0.2.112 49799 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 11:34:10.779371 0.108204 tcp 10.0.2.112 49805 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:35:53.410647 2.999624 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:36:00.417521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:36:08.417590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:36:24.420179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:36:56.426324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:43:00.432334 3.001912 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:43:07.439791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:43:15.441198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:43:31.446734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:44:03.450690 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:50:07.456274 3.001818 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:50:14.463648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:50:22.465013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:50:38.468590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:51:10.474241 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:57:14.481446 3.000730 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:57:21.487662 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:57:29.488830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:57:45.492252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:58:17.498012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:04:10.648084 0.012102 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:04:10.660304 0.117342 tcp 10.0.2.112 49806 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:04:10.802062 0.115331 tcp 10.0.2.112 49807 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:04:21.504936 3.000094 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:04:28.511421 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:04:36.512787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:04:52.515355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:05:24.522059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:11:28.527103 3.002778 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:11:35.534762 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:11:43.536846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:11:59.539991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:12:31.545733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:18:35.551466 3.101686 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:18:42.625015 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:18:50.570748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:19:06.573717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:19:38.590091 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:25:42.608304 3.054217 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:25:49.642337 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:25:57.624851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:26:13.628072 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:26:45.633972 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:32:49.640726 3.027299 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:32:56.657378 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:33:04.658735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:33:20.661879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:33:52.668065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:34:10.656054 0.000049 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:34:10.656158 0.116798 tcp 10.0.2.112 49808 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:34:10.798670 0.114946 tcp 10.0.2.112 49809 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:39:56.674712 3.058212 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:40:03.712233 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:40:11.702366 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:40:27.706147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:40:59.721966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:47:05.582579 3.068703 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:47:12.598719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:47:20.490514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:47:36.276729 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:48:07.823713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:54:10.772073 3.147394 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:54:17.892443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:54:25.830313 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:54:41.794605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:55:13.809920 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:01:17.826531 3.024633 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:01:24.843283 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:01:32.844943 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:01:48.847911 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:02:20.854099 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:04:10.664304 0.042342 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:04:10.706781 0.679391 tcp 10.0.2.112 49810 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:04:11.410687 0.116785 tcp 10.0.2.112 49811 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:08:24.860440 3.214742 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:08:32.037118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:08:39.963857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:08:55.881978 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:09:27.888198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:15:31.894062 3.012120 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:15:38.911281 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:15:46.912734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:16:02.916003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:16:35.106846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:22:38.937229 3.120506 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:22:46.174713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:22:54.098350 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:23:09.959972 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:23:41.968056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:29:45.972991 3.104366 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:29:53.050411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:30:00.990641 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:30:16.993772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:30:48.999915 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:34:10.671690 0.233170 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:34:10.905053 0.358729 tcp 10.0.2.112 49812 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:34:11.288283 0.107817 tcp 10.0.2.112 49813 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:36:53.008044 3.212604 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:37:00.190811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:37:08.112300 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:37:24.027996 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:37:58.639748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:44:00.050165 3.011408 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:44:07.067190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:44:15.068564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:44:31.071547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:45:03.077956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:51:07.083605 3.039262 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:51:14.102838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:51:22.102643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:51:38.183286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:52:10.122056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:58:14.128009 3.013150 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:58:21.145185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:58:29.155437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:58:45.149859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:59:17.193348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:04:10.679776 0.034554 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:04:10.714458 0.108094 tcp 10.0.2.112 49814 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:04:10.846844 0.214809 tcp 10.0.2.112 49815 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:05:21.421903 2.967736 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:05:28.342263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:05:36.253077 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:05:52.173848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:06:24.221993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:12:28.195914 3.001482 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:12:35.202627 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:12:43.208816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:12:59.207850 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:13:31.213746 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:19:35.239855 3.067873 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:19:42.327772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:19:50.300451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:20:06.291570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:20:38.317736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:26:42.388175 3.029241 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:26:49.891382 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:26:57.796237 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:27:13.601224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:27:45.371458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:33:54.384221 3.012945 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:34:01.402585 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:34:09.403982 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:34:10.688192 0.000050 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:34:10.688285 0.116861 tcp 10.0.2.112 49816 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:34:10.829524 0.114565 tcp 10.0.2.112 49817 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:34:25.406981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:34:57.412817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:41:01.418720 3.019077 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:41:08.436446 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:41:16.438289 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:41:32.440818 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:42:04.989945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:48:08.464387 3.010102 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:48:15.480277 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:48:23.481811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:48:39.484308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:49:11.490855 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:55:15.496913 3.001767 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:55:22.505486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:55:30.505838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:55:46.509213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:56:18.580695 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:02:22.521514 3.011104 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:02:29.538168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:02:37.539880 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:02:53.542857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:03:25.548876 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:04:10.696489 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:04:10.696688 0.115012 tcp 10.0.2.112 49818 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:04:10.838506 0.108355 tcp 10.0.2.112 49819 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:04:17.878159 0.009808 udp 10.0.2.112 63356 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 15:04:17.888667 0.135738 tcp 10.0.2.112 49820 -> 37.19.5.65 80 FSPA* 0 0 13 5562 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:09:29.555334 3.011375 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:09:36.572472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:09:44.574145 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:10:00.576748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:10:32.582749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:16:36.589053 3.001586 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:16:43.596414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:16:51.597807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:17:07.600761 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:17:39.606558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:24:31.624307 2.999644 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:24:38.629467 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:24:46.630728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:25:02.633986 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:25:34.643569 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:31:53.647066 3.002926 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:32:00.654719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:32:08.656441 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:32:24.659503 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:32:56.665404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:34:10.703967 0.000064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:34:10.704127 0.108277 tcp 10.0.2.112 49821 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:34:10.836329 0.114613 tcp 10.0.2.112 49822 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:39:00.671463 3.001996 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:39:07.679146 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:39:15.680601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:39:31.684290 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:40:03.689656 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:46:07.694794 3.002612 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:46:14.702991 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:46:22.788631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:46:38.717489 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:47:10.723713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:53:14.729370 3.001939 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:53:21.736728 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:53:29.738374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:53:45.741545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:54:17.747726 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:00:21.753493 3.001595 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:00:28.760592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:00:36.762231 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:00:52.765216 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:01:24.771136 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:04:10.711689 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:04:10.711834 0.116961 tcp 10.0.2.112 49823 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:04:10.853680 0.108138 tcp 10.0.2.112 49824 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:07:28.777594 3.001569 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:07:35.784712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:07:43.786498 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:07:59.789471 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:08:31.795177 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:14:35.801989 3.000847 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:14:42.808737 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:14:50.810263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:15:06.813480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:15:38.819575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:21:42.824814 3.569738 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:21:50.355626 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:21:58.256890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:22:14.053325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:22:45.853547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:28:49.859871 3.001664 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:28:56.867068 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:29:04.868213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:29:20.874008 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:29:52.877344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:34:10.719842 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:34:10.719997 0.106165 tcp 10.0.2.112 49825 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:34:10.851981 0.108408 tcp 10.0.2.112 49826 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:35:56.883065 3.002297 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:36:03.890512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:36:11.891910 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:36:27.897389 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:36:59.900968 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:43:03.907328 3.011346 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:43:10.924824 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:43:18.926107 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:43:34.929396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:44:06.935458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:50:10.941129 3.001684 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:50:17.949480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:50:25.950339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:50:41.953093 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:51:13.959080 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:57:17.965277 3.058386 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:57:24.998675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:57:32.983929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:57:48.987402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:58:20.993348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:04:10.728455 0.000063 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:04:10.728574 0.116807 tcp 10.0.2.112 49827 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:04:10.869730 0.115033 tcp 10.0.2.112 49828 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:04:25.001064 2.999735 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:04:32.006558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:04:40.008085 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:04:56.011335 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:05:28.017351 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:11:32.022632 3.017741 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:11:39.040443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:11:47.043397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:12:03.045426 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:12:35.051448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:18:39.057102 3.011633 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:18:46.074381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:18:54.076168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:19:10.079468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:19:42.085318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:25:46.091356 3.015134 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:25:53.108385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:26:01.109895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:26:17.114767 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:26:49.118856 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:32:53.124753 3.011951 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:33:00.142402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:33:08.144000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:33:24.147137 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:33:56.152852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:34:10.736595 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:34:10.736726 0.108513 tcp 10.0.2.112 49829 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:34:10.871352 0.116807 tcp 10.0.2.112 49830 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:40:00.161879 3.011626 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:40:07.176411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:40:15.177849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:40:31.183935 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:41:03.190299 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:47:07.193636 3.000987 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:47:14.200238 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:47:22.201613 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:47:38.205286 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:48:10.210802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:54:14.216749 3.002061 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:54:21.224140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:54:29.225477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:54:45.228831 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:55:17.234508 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:01:21.241061 3.070910 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:01:28.285122 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:01:36.259886 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:01:52.262747 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:02:24.268741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:04:10.743953 0.000042 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:04:10.744048 0.115276 tcp 10.0.2.112 49831 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:04:10.883426 0.117133 tcp 10.0.2.112 49832 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:08:28.274958 3.001321 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:08:35.282243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:08:43.283650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:08:59.287025 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:09:31.292610 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:15:35.298576 3.013447 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:15:42.315751 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:15:50.317652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:16:06.320144 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:16:38.340385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:22:42.333524 3.000718 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:22:49.340393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:22:57.345487 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:23:13.344948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:23:45.350677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:29:49.357277 3.001188 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:29:56.364199 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:30:04.368883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:30:20.368715 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:30:52.374649 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:34:10.752375 0.000068 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:34:10.752521 0.115107 tcp 10.0.2.112 49833 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:34:10.891634 0.116771 tcp 10.0.2.112 49834 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:36:56.380599 3.001433 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:37:03.388687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:37:11.390023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:37:27.392124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:37:59.398603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:44:03.404119 3.001676 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:44:10.411675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:44:18.413771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:44:34.420344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:45:06.422667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:51:10.431323 3.000884 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:51:17.448255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:51:25.438554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:51:41.441318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:52:13.447301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:58:17.452466 3.001365 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:58:24.459774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:58:32.465392 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:58:48.466424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:59:20.470717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:04:10.759835 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:04:10.759986 0.106304 tcp 10.0.2.112 49835 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:04:10.889580 0.117178 tcp 10.0.2.112 49836 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:04:17.885548 0.023887 udp 10.0.2.112 52790 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 19:04:17.910089 0.557437 tcp 10.0.2.112 49837 -> 37.19.5.65 80 FSPA* 0 0 13 5550 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:05:24.476172 3.002170 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:05:31.483734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:05:39.485466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:05:55.491200 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:06:27.494393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:12:31.500912 3.010889 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:12:38.518149 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:12:46.519659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:13:02.522766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:13:34.528702 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:19:38.534877 3.000782 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:19:45.541952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:19:53.543217 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:20:09.546636 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:20:41.552494 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:26:45.558530 3.001696 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:26:52.565885 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:27:00.567813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:27:16.571998 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:27:48.576608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:33:54.585112 3.025702 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:34:01.613500 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:34:09.614349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:34:10.768314 0.000098 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:34:10.768500 0.115177 tcp 10.0.2.112 49838 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:34:10.906718 0.114879 tcp 10.0.2.112 49839 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:34:25.617443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:34:57.623675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:41:01.629061 3.012497 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:41:08.647259 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:41:16.648435 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:41:32.651404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:42:04.657531 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:48:08.663480 3.001155 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:48:15.670482 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:48:23.674141 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:48:39.675421 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:49:11.681012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:55:15.687801 3.001279 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:55:22.694739 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:55:30.696210 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:55:46.700480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:56:18.705720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:02:23.109570 3.022687 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:02:30.095304 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:02:38.022789 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:02:53.875252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:03:25.739193 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:04:10.776333 0.000069 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:04:10.776480 0.105552 tcp 10.0.2.112 49840 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:04:10.905536 0.117412 tcp 10.0.2.112 49841 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:09:29.745215 3.028506 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:09:36.762833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:09:44.764162 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:10:00.767420 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:10:32.773168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:16:36.780564 3.000364 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:16:43.786704 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:16:51.788254 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:17:07.791094 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:17:39.797070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:24:35.809837 2.999943 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:24:42.815560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:24:50.816594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:25:06.820924 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:25:38.826039 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:31:58.834872 3.231502 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:32:06.038042 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:32:13.962055 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:32:29.866691 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:33:01.929541 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:34:10.784886 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:34:10.784999 0.117149 tcp 10.0.2.112 49842 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:34:10.927012 0.115006 tcp 10.0.2.112 49843 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:39:05.889049 3.011539 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:39:12.906533 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:39:20.908208 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:39:36.911211 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:40:08.916839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:46:12.924220 3.000469 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:46:19.930438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:46:27.931953 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:46:43.934829 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:47:15.941182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:53:19.946179 3.002280 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:53:26.954073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:53:34.955969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:53:50.958871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:54:22.964610 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:00:26.971889 3.000588 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:00:34.056790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:00:41.994713 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:00:57.982676 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:01:29.988833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:04:08.550724 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:04:08.550923 0.009743 udp 10.0.2.112 55802 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/06 21:04:08.561125 0.195827 tcp 10.0.2.112 49844 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:04:10.791744 0.009783 udp 10.0.2.112 59130 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/06 21:04:10.801997 0.115475 tcp 10.0.2.112 49845 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:04:10.940633 0.106635 tcp 10.0.2.112 49846 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:04:19.653680 0.117588 tcp 10.0.2.112 49847 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:04:38.746335 0.000165 tcp 10.0.2.112 49844 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:07:33.997347 2.999098 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/06 21:07:41.002322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:07:49.003556 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:08:05.006771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:08:37.012868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:09:11.617128 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:09:11.617389 0.009936 udp 10.0.2.112 50722 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 21:09:11.627758 0.126310 tcp 10.0.2.112 49848 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:14:41.019659 3.011936 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:14:48.036167 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:14:56.038057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:15:12.040605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:15:44.046979 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:21:48.058785 3.558622 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:21:55.571859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:22:03.473674 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:22:19.273141 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:22:51.080869 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:28:55.086756 3.001855 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:29:02.094227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:29:10.095699 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:29:26.098560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:29:58.104588 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:34:10.799956 0.000083 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:34:10.800120 0.108221 tcp 10.0.2.112 49849 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:34:10.908520 0.000033 tcp 10.0.2.112 49844 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 21:34:10.932346 0.116858 tcp 10.0.2.112 49850 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:36:02.110473 3.001691 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:36:09.118173 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:36:17.119813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:36:33.122512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:37:05.128918 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:43:09.135718 3.091690 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:43:16.200443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:43:24.154135 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:43:40.159415 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:44:12.162772 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:50:16.169218 3.011175 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:50:23.187575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:50:31.187612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:50:47.190673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:51:19.196604 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:57:23.202314 3.020988 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:57:30.223666 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:57:38.221630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:57:54.224407 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:58:26.231248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:04:10.807765 0.010546 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:04:10.818383 0.117346 tcp 10.0.2.112 49851 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:04:10.958983 0.106154 tcp 10.0.2.112 49852 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:04:30.236951 3.001272 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:04:37.244045 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:04:45.245762 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:05:01.248488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:05:33.254626 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:11:37.260828 3.012453 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:11:44.278159 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:11:52.279677 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:12:08.282360 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:12:40.288303 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:18:44.294553 3.001637 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:18:51.302012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:18:59.303430 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:19:15.306362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:19:47.715146 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:25:51.339251 3.021097 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:25:58.365473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:26:06.368059 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:26:22.370799 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:26:54.376388 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:32:58.382545 3.001390 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:33:05.389890 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:33:13.391473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:33:29.394019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:34:01.400434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:34:10.816096 0.000108 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:34:10.816305 0.114920 tcp 10.0.2.112 49853 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:34:10.954647 0.169264 tcp 10.0.2.112 49854 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:40:05.406467 3.011248 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:40:12.423480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:40:20.425551 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:40:36.428480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:41:08.434594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:47:12.441106 3.012826 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:47:19.457880 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:47:27.460479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:47:43.462381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:48:15.468464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:54:19.473914 3.002202 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:54:26.481817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:54:34.492818 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:54:50.486027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:55:22.492348 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:01:26.497856 3.012358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:01:33.531884 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:01:41.517533 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:01:57.520443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:02:29.526391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:04:10.824985 0.000057 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:04:10.825100 0.108831 tcp 10.0.2.112 49855 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:04:10.962399 0.105974 tcp 10.0.2.112 49856 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:04:17.890159 0.009857 udp 10.0.2.112 62007 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/06 23:04:17.900700 0.131998 tcp 10.0.2.112 49857 -> 37.19.5.65 80 FSPA* 0 0 13 5638 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:08:33.532974 3.013062 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:08:40.550178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:08:48.551786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:09:04.554643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:09:36.560609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:15:40.566543 3.014713 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:15:47.583900 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:15:55.585450 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:16:11.588182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:16:43.594297 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:23:54.606999 3.011520 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:24:01.624455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:24:09.625491 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:24:25.628854 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:24:57.634542 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:31:25.646696 3.011144 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:31:32.662604 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:31:40.665623 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:31:56.666808 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:32:28.672521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:34:10.833020 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:34:10.833136 0.117202 tcp 10.0.2.112 49858 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:34:10.974369 0.115412 tcp 10.0.2.112 49859 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:38:32.679085 3.011973 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:38:39.696730 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:38:47.698647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:39:03.701036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:39:35.706989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:45:39.712901 3.001860 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:45:46.720307 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:45:54.722202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:46:10.724849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:46:43.216535 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:52:46.748470 3.287318 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:52:54.002580 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:53:01.927764 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:53:17.791996 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:53:49.775540 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:59:53.780771 3.004502 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:00:00.790740 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:00:08.793563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:00:24.792864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:00:56.798934 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:04:10.840157 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:04:10.840277 0.117567 tcp 10.0.2.112 49860 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:04:10.982130 0.105676 tcp 10.0.2.112 49861 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:07:00.805544 3.001084 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:07:07.812305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:07:15.813951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:07:31.816969 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:08:05.143022 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:14:07.839594 3.001241 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:14:14.846398 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:14:22.848312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:14:38.852392 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:15:10.856931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:21:14.862877 3.001675 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:21:21.907178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:21:30.005474 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:21:45.885189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:22:18.661571 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:28:21.907451 3.001059 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:28:29.004953 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:28:36.941397 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:28:52.928952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:29:24.935134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:34:10.848669 0.000305 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:34:10.849091 0.106267 tcp 10.0.2.112 49862 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:34:10.980231 0.117074 tcp 10.0.2.112 49863 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:35:28.945047 2.997578 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:35:36.604686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:35:44.526734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:36:00.360527 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:36:32.640986 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:42:35.986633 2.999861 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:42:42.992432 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:42:50.993938 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:43:06.996922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:43:39.003143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:49:43.009373 3.001158 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:49:50.016443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:49:58.017893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:50:14.030608 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:50:46.036552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:56:50.089204 3.181119 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:56:57.236502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:57:05.160752 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:57:21.054807 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:57:53.060917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:03:57.076453 3.002125 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:04:04.089570 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:04:10.866178 0.000074 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:04:10.866345 0.115785 tcp 10.0.2.112 49864 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:04:11.006425 0.108310 tcp 10.0.2.112 49865 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:04:12.085777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:04:28.088846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:05:00.095648 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:11:04.101707 3.000852 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:11:11.111393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:11:19.109753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:11:35.112802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:12:07.118653 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:18:11.135234 3.001201 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:18:18.142171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:18:26.143703 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:18:42.146697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:19:14.152742 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:25:21.163277 3.013175 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:25:28.180547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:25:36.185820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:25:52.185355 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:26:24.191131 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:32:28.197995 3.000769 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:32:35.204182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:32:43.205942 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:32:59.209157 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:33:31.216180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:34:10.890190 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:34:10.890304 0.108724 tcp 10.0.2.112 49866 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:34:11.022832 0.115216 tcp 10.0.2.112 49867 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:39:35.220915 3.011753 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:39:42.238349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:39:50.240020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:40:06.243318 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:40:38.271179 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:46:42.264919 3.001318 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:46:49.272488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:46:57.273874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:47:13.277010 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:47:45.282731 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:53:49.289516 3.001295 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:53:56.296451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:54:04.297802 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:54:20.301242 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:54:52.306404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:00:56.312785 3.001618 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:01:03.320419 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:01:11.321684 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:01:27.325104 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:01:59.330668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:04:10.882441 0.000247 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:04:10.882786 0.117409 tcp 10.0.2.112 49868 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:04:11.023627 0.105907 tcp 10.0.2.112 49869 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:08:03.336854 3.001628 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:08:10.344443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:08:18.346245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:08:34.348800 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:09:06.359895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:15:10.362978 2.999738 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:15:17.368275 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:15:25.369834 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:15:41.372776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:16:13.379057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:22:17.385638 3.001011 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:22:24.393917 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:22:32.393342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:22:48.396801 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:23:20.402881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:29:24.409255 3.001410 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:29:31.416163 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:29:39.417847 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:29:55.420983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:30:27.426654 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:34:10.891923 0.000075 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:34:10.892040 0.108304 tcp 10.0.2.112 49870 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:34:11.031593 0.114982 tcp 10.0.2.112 49871 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:36:31.433601 3.000813 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:36:38.666534 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:36:46.590630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:37:02.457468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:37:34.461003 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:43:38.467264 3.001029 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:43:45.476037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:43:53.475121 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:44:09.478707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:44:41.484881 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:50:45.492019 3.001568 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:50:52.498140 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:51:00.499831 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:51:16.502534 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:51:48.508755 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:57:52.515702 3.000935 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:57:59.522579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:58:07.523958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:58:23.526437 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:58:55.532567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:04:10.898849 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:04:10.899050 0.111480 tcp 10.0.2.112 49872 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:04:11.032028 0.115592 tcp 10.0.2.112 49873 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:04:17.902184 0.011560 udp 10.0.2.112 60100 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 03:04:17.914576 0.116181 tcp 10.0.2.112 49874 -> 37.19.5.65 80 FSPA* 0 0 13 5586 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:04:59.538234 3.004571 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:05:06.546222 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:05:14.551496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:05:30.551456 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:06:02.556594 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:12:06.563122 3.001118 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:12:13.570139 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:12:21.571693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:12:37.574554 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:13:09.581553 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:19:13.585907 3.002235 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:19:20.594028 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:19:28.598247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:19:44.598555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:20:16.604672 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:26:20.610518 3.001753 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:26:27.617981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:26:35.619539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:26:51.622253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:27:23.628378 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:33:27.634515 3.001182 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:33:34.648497 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:33:42.643575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:33:58.646324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:34:10.906574 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:34:10.906679 0.115023 tcp 10.0.2.112 49875 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:34:11.047493 0.117419 tcp 10.0.2.112 49876 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:34:30.652559 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:40:34.659022 3.001166 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:40:41.665472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:40:49.667386 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:41:05.670414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:41:37.676383 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:47:41.682518 3.001478 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:47:48.689773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:47:56.691731 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:48:12.694245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:48:44.700329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:54:48.705929 3.002319 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:54:55.720459 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:55:03.715244 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:55:19.718438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:55:51.727615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:01:55.730118 3.002004 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:02:02.737778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:02:10.739340 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:02:26.742345 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:02:58.748405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:04:10.914256 0.000048 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:04:10.914352 0.117732 tcp 10.0.2.112 49877 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:04:11.056344 0.118385 tcp 10.0.2.112 49878 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:09:02.754242 3.001667 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:09:09.761791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:09:17.763531 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:09:33.766251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:10:05.772246 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:16:09.778869 3.001327 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:16:16.785777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:16:24.786793 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:16:40.790424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:17:12.796196 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:24:17.810293 3.001525 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:24:24.817258 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:24:32.819141 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:24:48.822126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:25:20.828052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:31:46.835973 3.001072 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:31:53.843249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:32:01.844666 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:32:17.847718 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:32:49.853667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:34:10.922775 0.000221 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:34:10.923113 0.107030 tcp 10.0.2.112 49879 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:34:11.057589 0.106830 tcp 10.0.2.112 49880 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:38:53.859471 3.011752 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:39:00.876928 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:39:08.880829 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:39:24.883644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:39:56.887527 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:46:00.893543 3.001575 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:46:07.900959 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:46:15.902640 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:46:31.905605 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:47:03.911668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:53:07.918001 3.001459 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:53:14.925226 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:53:22.926621 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:53:38.929460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:54:10.935651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:00:14.942238 3.001055 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:00:21.948954 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:00:29.953680 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:00:45.953720 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:01:17.959682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:04:10.929968 0.000104 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:04:10.930154 0.106627 tcp 10.0.2.112 49881 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:04:11.063179 0.108770 tcp 10.0.2.112 49882 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:07:21.965291 3.001906 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:07:28.974438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:07:36.974405 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:07:52.977284 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:08:24.983635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:14:28.993217 3.000500 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:14:35.996835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:14:43.998287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:15:00.001373 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:15:32.007787 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:21:36.014733 3.000181 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:21:43.023725 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:21:51.022433 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:22:07.025298 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:22:39.031439 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:28:43.037830 3.001622 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:28:50.045452 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:28:58.046263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:29:14.050506 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:29:46.055422 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:34:10.938993 0.000210 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:34:10.939296 0.117889 tcp 10.0.2.112 49883 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:34:11.080441 0.116902 tcp 10.0.2.112 49884 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:35:50.061726 3.004178 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:35:57.068587 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:36:05.070255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:36:21.074616 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:36:53.079202 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:42:57.085835 3.001623 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:43:04.092852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:43:12.094023 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:43:28.097466 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:44:00.103421 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:50:04.109179 3.001681 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:50:11.119423 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:50:19.117980 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:50:35.121944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:51:07.129979 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:57:11.133162 3.001667 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:57:18.145637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:57:26.142088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:57:42.145428 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:58:14.151194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:04:10.946101 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:04:10.946198 0.114885 tcp 10.0.2.112 49885 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:04:11.087397 0.109547 tcp 10.0.2.112 49886 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:04:18.156889 3.001882 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:04:25.164717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:04:33.166098 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:04:49.169305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:05:21.175180 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:11:25.180660 3.002114 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:11:32.188547 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:11:40.190079 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:11:56.197315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:12:28.199311 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:18:32.205049 3.001824 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:18:39.212495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:18:47.213514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:19:03.216771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:19:35.222936 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:25:39.229295 3.001540 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:25:46.236451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:25:54.238035 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:26:10.241089 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:26:42.246816 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:32:46.252954 3.001581 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:32:53.260387 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:33:01.261993 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:33:17.265036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:33:49.270820 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:34:10.953968 0.000059 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:34:10.954110 0.108534 tcp 10.0.2.112 49887 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:34:11.087418 0.106676 tcp 10.0.2.112 49888 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:39:53.276427 3.002368 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:40:00.286730 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:40:08.286655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:40:24.289016 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:40:56.294375 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:47:00.301864 3.000657 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:47:07.316790 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:47:15.310024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:47:31.313200 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:48:03.319249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:54:07.325668 3.000964 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:54:14.331734 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:54:22.333468 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:54:38.336922 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:55:10.342470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:01:14.348819 3.004493 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:01:21.356149 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:01:29.359778 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:01:45.360708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:02:17.366749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:04:08.563106 0.000061 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:04:08.563243 0.009719 udp 10.0.2.112 58886 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/07 07:04:08.573558 0.198457 tcp 10.0.2.112 49889 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:04:10.961464 0.009761 udp 10.0.2.112 60241 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/07 07:04:10.971696 0.109740 tcp 10.0.2.112 49890 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:04:11.108681 0.117885 tcp 10.0.2.112 49891 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:04:17.904955 0.009568 udp 10.0.2.112 64677 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 07:04:17.915368 0.118596 tcp 10.0.2.112 49892 -> 37.19.5.65 80 FSPA* 0 0 13 5577 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:04:19.781788 0.010110 udp 10.0.2.112 64202 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/07 07:04:19.811130 0.109431 tcp 10.0.2.112 49893 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:04:38.747235 0.000153 tcp 10.0.2.112 49889 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:08:21.372943 3.001746 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/07 07:08:28.380263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:08:36.381512 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:08:52.384804 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:09:24.392637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:15:28.396376 3.002096 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:15:35.404198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:15:43.405270 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:15:59.408668 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:16:31.414798 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:22:35.420344 3.002211 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:22:42.428198 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:22:50.429745 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:23:06.432835 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:23:38.438638 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:29:42.445437 3.001116 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:29:49.452849 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:29:57.453706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:30:13.459332 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:30:45.462312 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:34:10.970047 0.000070 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:34:10.970195 0.117258 tcp 10.0.2.112 49894 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:34:11.087612 0.000059 tcp 10.0.2.112 49889 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/07 07:34:11.110847 0.106358 tcp 10.0.2.112 49895 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:36:49.468029 3.002340 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:36:56.475808 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:37:04.477748 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:37:20.480718 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:37:52.486283 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:43:56.492682 3.011801 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:44:03.510264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:44:11.511158 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:44:27.515032 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:44:59.520683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:51:03.527079 3.001173 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:51:10.533937 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:51:18.535309 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:51:34.538738 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:52:06.544646 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:58:10.549910 3.002345 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:58:17.557846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:58:25.559675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:58:41.568040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:59:13.568667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:04:10.978871 0.000215 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:04:10.979138 0.117404 tcp 10.0.2.112 49896 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:04:11.120599 0.108162 tcp 10.0.2.112 49897 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:05:17.574716 3.001124 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:05:24.586265 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:05:32.583495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:05:48.586473 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:06:20.592439 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:12:24.602146 2.999868 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:12:31.605989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:12:39.607636 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:12:55.610590 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:13:27.616494 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:19:31.622560 3.001864 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:19:38.630090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:19:46.631504 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:20:02.633973 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:20:34.640447 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:26:38.647603 3.000916 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:26:45.653941 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:26:53.655486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:27:09.658545 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:27:41.664520 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:33:45.671499 3.001019 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:33:52.677822 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:34:00.679246 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:34:10.986892 0.000068 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:34:10.987017 0.115230 tcp 10.0.2.112 49898 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:34:11.132129 0.116920 tcp 10.0.2.112 49899 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:34:16.682413 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:34:48.688418 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:40:52.694660 3.001380 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:40:59.701775 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:41:07.703582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:41:23.706464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:41:55.712546 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:47:59.720067 2.999911 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:48:06.725872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:48:14.727370 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:48:30.730252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:49:02.736651 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:55:06.742636 3.001516 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:55:13.749931 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:55:21.751741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:55:37.754166 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:56:09.760213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:02:13.766728 3.001266 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:02:20.773848 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:02:28.775499 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:02:44.778201 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:03:16.784345 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:04:10.994154 0.000077 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:04:10.994313 0.114782 tcp 10.0.2.112 49900 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:04:11.140372 0.115262 tcp 10.0.2.112 49901 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:09:20.790738 3.013242 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:09:27.807719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:09:35.809315 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:09:51.812251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:10:23.818212 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:16:27.824554 3.001306 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:16:34.831965 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:16:42.833792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:16:58.836062 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:17:30.842357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:24:31.852153 2.999872 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:24:38.857712 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:24:46.863644 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:25:02.862124 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:25:34.868109 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:31:57.882238 3.000820 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:32:04.888696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:32:12.890394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:32:28.893589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:33:00.899717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:34:11.002632 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:34:11.003097 0.117301 tcp 10.0.2.112 49902 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:34:11.144277 0.108676 tcp 10.0.2.112 49903 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:39:04.908277 3.008953 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:39:11.925659 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:39:19.924186 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:39:35.927479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:40:07.933781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:46:11.940195 3.332787 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:46:19.235560 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:46:27.163302 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:46:43.015865 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:47:14.967842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:53:18.973426 3.016638 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:53:25.994628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:53:33.992200 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:53:49.995583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:54:22.011480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:00:26.027065 3.012244 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:00:33.046227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:00:41.046235 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:00:57.049249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:01:29.065582 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:04:11.010483 0.010945 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:04:11.021593 0.105918 tcp 10.0.2.112 49904 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:04:11.151980 0.115082 tcp 10.0.2.112 49905 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:07:33.082325 3.010964 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:07:40.099005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:07:48.102175 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:08:04.113868 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:08:36.129631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:14:40.135298 3.012208 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:14:47.152886 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:14:55.154474 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:15:11.157341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:15:43.164652 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:21:47.169590 3.011679 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:21:54.186735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:22:02.188522 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:22:18.191487 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:22:50.197424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:28:54.203939 3.011915 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:29:01.221647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:29:09.222157 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:29:25.225436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:29:57.240939 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:34:11.018208 0.003236 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:34:11.021535 0.124451 tcp 10.0.2.112 49906 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:34:11.170535 0.115102 tcp 10.0.2.112 49907 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:36:01.257821 3.001507 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:36:08.264678 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:36:16.266500 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:36:32.269878 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:37:04.275066 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:43:08.285841 2.997197 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:43:15.289000 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:43:23.290206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:43:39.293227 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:44:11.349374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:50:15.305243 3.002180 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:50:22.312655 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:50:30.315956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:50:46.318245 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:51:18.323612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:57:22.329496 3.001723 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:57:29.336663 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:57:37.338226 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:57:53.341243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:58:25.347458 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:04:11.026086 0.000055 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:04:11.026331 0.115118 tcp 10.0.2.112 49908 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:04:11.165877 0.117388 tcp 10.0.2.112 49909 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:04:17.909134 0.013984 udp 10.0.2.112 64816 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 11:04:17.923865 0.116065 tcp 10.0.2.112 49910 -> 37.19.5.65 80 FSPA* 0 0 13 5586 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:04:29.353492 3.001426 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:04:36.361081 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:04:44.365960 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:05:00.365288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:05:32.371347 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:11:36.376796 3.022352 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:11:43.404795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:11:51.406344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:12:07.409495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:12:39.415650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:18:43.420644 3.002000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:18:50.428724 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:18:58.430126 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:19:14.433493 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:19:46.439253 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:25:50.445235 3.002824 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:25:57.452185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:26:05.454090 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:26:21.457408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:26:53.462951 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:32:57.468853 3.002248 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:33:04.476679 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:33:12.478182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:33:28.481434 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:34:00.487336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:34:11.034873 0.000067 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:34:11.035049 0.155805 tcp 10.0.2.112 49911 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:34:11.219169 0.116925 tcp 10.0.2.112 49912 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:40:04.494389 3.010875 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:40:11.510893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:40:19.512099 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:40:35.515311 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:41:07.521301 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:47:11.527231 3.001346 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:47:18.534041 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:47:26.593206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:47:42.539078 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:48:14.545324 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:54:18.551871 3.010331 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:54:25.572322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:54:33.570135 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:54:49.572785 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:55:21.578932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:01:25.585678 3.164711 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:01:32.721915 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:01:40.643873 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:01:57.091502 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:02:28.854278 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:04:11.043069 0.020648 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:04:11.063833 0.538215 tcp 10.0.2.112 49913 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:04:11.626104 0.114838 tcp 10.0.2.112 49914 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:08:32.638349 3.022183 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:08:39.666161 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:08:47.678589 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:09:03.680944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:09:35.686480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:15:39.692774 3.159584 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:15:46.822054 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:15:54.747959 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:16:10.719455 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:16:42.720880 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:23:53.734069 3.058425 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:24:00.772329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:24:08.752160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:24:24.755339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:24:56.761411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:31:24.772260 3.093420 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:31:31.837859 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:31:39.790836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:31:55.794267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:32:27.799948 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:34:11.051050 0.000106 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:34:11.051244 0.108775 tcp 10.0.2.112 49915 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:34:11.186916 0.106132 tcp 10.0.2.112 49916 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:38:31.805715 3.087377 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:38:38.867311 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:38:46.824564 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:39:02.827944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:39:34.833754 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:45:38.853995 3.051908 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:45:45.881191 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:45:53.868603 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:46:09.871867 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:46:41.877631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:52:45.884285 3.011231 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:52:52.900774 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:53:00.902771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:53:16.905958 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:53:48.911708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:59:52.918061 3.025642 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:59:59.935125 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:00:07.936670 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:00:23.940056 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:00:55.945647 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:04:11.058245 0.031897 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:04:11.090269 0.114962 tcp 10.0.2.112 49917 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:04:11.228841 0.116957 tcp 10.0.2.112 49918 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:06:59.951573 3.025658 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:07:06.969189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:07:14.970700 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:07:31.386343 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:08:02.999491 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:14:06.996137 3.108993 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:14:14.080444 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:14:22.017457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:14:38.017588 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:15:10.023682 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:21:14.030108 3.482797 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:21:21.475342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:21:29.401693 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:21:49.013013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:22:20.562168 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:28:21.074678 3.201496 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:28:28.247339 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:28:36.248395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:28:52.099031 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:29:27.971322 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:34:11.067298 0.159537 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:34:11.227072 0.106988 tcp 10.0.2.112 49919 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:34:11.360321 0.108607 tcp 10.0.2.112 49920 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:35:28.118034 3.001248 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:35:35.124994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:35:43.129492 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:35:59.129667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:36:31.142414 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:42:35.142024 3.350825 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:42:42.456394 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:42:50.381101 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:43:06.231021 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:43:38.169698 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:49:42.175171 3.034505 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:49:49.197243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:49:57.194576 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:50:13.197794 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:50:45.203326 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:56:49.211265 3.095796 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:56:56.278786 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:57:04.228404 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:57:20.231935 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:57:52.237664 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:03:56.244175 3.011075 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:04:03.260908 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:04:11.074195 0.000049 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:04:11.074283 0.106437 tcp 10.0.2.112 49921 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:11.212455 0.114790 tcp 10.0.2.112 49922 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:11.264756 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:04:27.265705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:04:59.271597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:11:03.277188 3.062374 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:11:10.318386 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:11:18.306498 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:11:34.309521 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:12:20.775893 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:18:19.779014 2.958429 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:18:26.684325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:18:34.578182 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:18:50.349411 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:19:21.900932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:25:24.828454 2.976528 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:25:31.754477 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:25:39.643791 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:25:55.424669 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:26:26.979064 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:32:28.394981 3.012062 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:32:35.412792 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:32:43.415054 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:32:59.417580 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:33:31.423451 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:34:11.083976 0.042275 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:34:11.126432 0.115461 tcp 10.0.2.112 49923 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:34:11.269600 0.114538 tcp 10.0.2.112 49924 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:39:35.429865 3.085114 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:39:42.483263 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:39:50.448336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:40:06.450932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:40:38.457471 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:46:42.463807 3.090154 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:46:49.702149 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:46:57.629839 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:47:13.484908 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:47:45.491215 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:53:49.496711 3.017334 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:53:56.514305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:54:04.516305 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:54:20.519607 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:54:52.524877 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:00:56.531753 3.011279 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:01:03.548736 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:01:11.550244 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:01:27.553134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:01:59.569259 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:04:11.093055 0.000105 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:04:11.093246 0.114788 tcp 10.0.2.112 49925 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:04:11.237398 0.106135 tcp 10.0.2.112 49926 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:04:17.912515 0.118725 udp 10.0.2.112 50898 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 15:04:18.031957 0.116208 tcp 10.0.2.112 49927 -> 37.19.5.65 80 FSPA* 0 0 13 5677 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:08:03.575623 3.041594 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:08:10.598248 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:08:18.594280 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:08:34.597255 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:09:06.602619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:15:10.608800 3.012745 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:15:17.626419 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:15:25.628200 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:15:41.630619 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:16:13.637045 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:22:17.644036 3.010853 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:22:24.660724 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:22:32.665483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:22:48.666203 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:23:20.675782 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:29:24.676704 3.012579 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:29:31.694733 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:29:39.695966 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:29:55.699331 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:30:27.709314 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:34:11.098431 0.011800 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:34:11.110396 0.108252 tcp 10.0.2.112 49928 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:34:11.247229 0.117087 tcp 10.0.2.112 49929 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:36:31.711564 3.012169 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:36:38.728481 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:36:46.730019 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:37:03.434239 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:37:35.048898 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:43:38.745451 3.000902 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:43:45.752683 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:43:53.754073 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:44:09.756563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:44:41.762888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:50:45.769109 3.028325 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:50:52.787038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:51:00.788134 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:51:16.791472 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:51:48.797110 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:57:52.803418 3.001188 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:57:59.810333 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:58:07.812020 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:58:23.814842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:58:55.821342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:04:11.106155 0.004289 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:04:11.110528 0.106056 tcp 10.0.2.112 49930 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:04:11.239831 0.117249 tcp 10.0.2.112 49931 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:04:59.827039 3.001583 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:05:06.834402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:05:14.835962 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:05:30.839261 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:06:02.844932 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:12:06.852670 3.995660 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:12:14.875741 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:12:22.777781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:12:38.575755 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:13:10.178609 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:19:13.884959 3.001860 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:19:20.892342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:19:28.894171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:19:44.897601 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:20:16.903241 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:26:20.909125 3.012401 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:26:27.926623 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:26:35.927895 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:26:51.935365 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:27:23.937291 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:33:27.942981 3.011771 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:33:34.960763 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:33:42.961904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:33:58.965287 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:34:11.114839 0.000058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:34:11.114961 0.117546 tcp 10.0.2.112 49932 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:34:11.256595 0.116846 tcp 10.0.2.112 49933 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:34:30.970766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:40:34.976954 3.116572 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:40:42.066063 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:40:49.997249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:41:05.998685 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:41:38.004994 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:47:42.011304 3.001141 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:47:49.018264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:47:57.019751 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:48:13.023010 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:48:45.028705 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:54:49.035336 3.011389 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:54:56.055870 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:55:04.053809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:55:20.056812 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:55:52.063060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:01:56.069104 3.012528 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:02:03.086114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:02:11.087784 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:02:27.091077 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:02:59.096795 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:04:08.560625 0.000054 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:04:08.560799 0.009733 udp 10.0.2.112 64327 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V2-DNS 1970/01/07 17:04:08.571070 0.386040 tcp 10.0.2.112 49934 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:04:11.122046 0.009746 udp 10.0.2.112 53646 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V2-DNS 1970/01/07 17:04:11.132359 0.108203 tcp 10.0.2.112 49935 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:04:11.264631 0.174303 tcp 10.0.2.112 49936 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:04:19.932321 0.115084 tcp 10.0.2.112 49937 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:04:38.747765 0.000156 tcp 10.0.2.112 49934 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:09:03.113074 3.042545 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/07 17:09:10.135143 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:09:18.135448 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:09:34.134638 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:10:06.141025 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:16:10.147132 3.016083 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:16:17.165374 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:16:25.166566 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:16:41.168886 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:17:13.175185 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:24:18.189259 3.010807 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:24:25.205385 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:24:33.207327 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:24:49.211686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:25:21.216428 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:31:46.222896 3.012167 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:31:53.240044 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:32:01.241864 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:32:17.244706 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:32:49.251952 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:34:11.130771 0.000116 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:34:11.130994 0.115294 tcp 10.0.2.112 49938 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:34:11.246373 0.000044 tcp 10.0.2.112 49934 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/07 17:34:11.270162 0.106039 tcp 10.0.2.112 49939 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:38:53.256457 3.182818 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:39:00.405436 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:39:08.327684 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:39:24.288697 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:39:56.294624 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:46:00.300550 3.012046 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:46:07.317935 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:46:15.319486 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:46:31.322488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:47:03.328707 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:53:07.334400 3.012173 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:53:14.352050 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:53:22.353643 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:53:38.356675 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:54:10.362213 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:00:14.369069 3.001410 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:00:21.376119 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:00:29.377719 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:00:45.380686 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:01:17.386393 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:04:11.138126 0.000047 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:04:11.138220 0.106085 tcp 10.0.2.112 49940 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:04:11.268987 0.105766 tcp 10.0.2.112 49941 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:07:21.393348 3.000752 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:07:28.400175 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:07:36.401760 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:07:52.406052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:08:24.410674 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:14:28.416037 3.012057 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:14:35.434037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:14:43.435336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:14:59.438776 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:15:31.444929 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:21:35.450449 3.013075 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:21:42.484495 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:21:50.470005 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:22:06.472548 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:22:38.478483 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:28:42.485406 3.000695 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:28:49.491889 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:28:57.493139 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:29:13.495813 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:29:45.502761 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:34:11.146417 0.000091 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:34:11.146583 0.117809 tcp 10.0.2.112 49942 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:34:11.288360 0.115018 tcp 10.0.2.112 49943 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:35:49.508219 3.002023 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:35:56.515687 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:36:04.517604 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:36:20.520567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:36:52.526265 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:42:56.533220 3.011703 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:43:03.550251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:43:11.551669 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:43:27.554438 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:43:59.560444 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:50:03.566431 3.001368 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:50:10.574708 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:50:18.575584 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:50:34.578230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:51:06.584415 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:57:10.590703 3.012554 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:57:17.608362 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:57:25.609637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:57:41.612307 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:58:13.618391 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:04:11.154493 0.008058 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:04:11.162665 0.115180 tcp 10.0.2.112 49944 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:04:11.304204 0.108136 tcp 10.0.2.112 49945 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:04:17.624382 3.001642 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:04:17.919090 0.009885 udp 10.0.2.112 59139 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 19:04:17.929729 0.838782 tcp 10.0.2.112 49946 -> 37.19.5.65 80 FSPA* 0 0 13 5650 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:04:24.631872 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:04:32.633528 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:04:48.637642 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:05:20.642765 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:11:24.649156 3.019883 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:11:31.665826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:11:39.667475 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:11:55.670294 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:12:27.676717 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:18:31.684207 3.010514 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:18:38.703888 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:18:46.701635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:19:02.704555 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:19:34.710231 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:25:38.715840 3.006945 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:25:45.723583 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:25:53.725496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:26:09.728525 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:26:41.734349 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:32:45.741100 3.011271 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:32:52.757995 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:33:00.759894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:33:16.763833 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:33:48.768251 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:34:11.163233 0.000095 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:34:11.163443 0.116986 tcp 10.0.2.112 49947 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:34:11.304065 0.117011 tcp 10.0.2.112 49948 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:39:52.774448 3.011751 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:39:59.791904 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:40:07.793364 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:40:23.796171 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:40:55.802036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:46:59.808835 3.000930 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:47:06.815836 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:47:14.817424 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:47:30.821256 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:48:02.826192 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:54:06.833172 3.010630 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:54:13.849838 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:54:21.850721 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:54:37.857769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:55:09.860330 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:01:13.865797 3.336289 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:01:21.171197 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:01:29.700754 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:01:45.507514 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:02:17.119054 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:04:11.170274 0.101321 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:04:11.271799 0.117475 tcp 10.0.2.112 49949 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:04:11.413826 0.116991 tcp 10.0.2.112 49950 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:08:20.900422 3.001518 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:08:27.907600 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:08:35.909482 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:08:51.912088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:09:23.917967 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:15:27.924397 3.011621 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:15:34.941620 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:15:42.943024 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:15:58.946108 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:16:30.952190 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:22:34.958489 3.014677 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:22:41.975558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:22:49.978052 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:23:05.980267 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:23:38.005308 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:29:41.992116 3.471862 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:29:49.431095 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:29:57.356879 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:30:13.203949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:30:45.020279 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:34:11.178436 0.000069 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:34:11.178580 0.115286 tcp 10.0.2.112 49951 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:34:11.316369 0.117093 tcp 10.0.2.112 49952 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:36:49.026047 3.025270 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:36:56.044661 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:37:04.060894 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:37:20.053735 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:37:52.054027 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:43:56.060892 3.000773 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:44:03.067061 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:44:11.069266 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:44:27.071809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:44:59.078045 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:51:03.085114 3.013173 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:51:10.101462 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:51:18.103207 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:51:34.105811 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:52:06.112258 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:58:10.119048 3.040967 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:58:17.138224 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:58:25.137233 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:58:41.139983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:59:13.566274 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:04:11.190439 0.039064 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:04:11.229690 0.138328 tcp 10.0.2.112 49953 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:04:11.391185 0.148264 tcp 10.0.2.112 49954 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:05:17.162268 3.001869 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:05:24.173632 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:05:32.171561 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:05:48.173956 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:06:20.180057 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:09:12.151941 0.000062 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:09:12.152044 0.009637 udp 10.0.2.112 50337 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 21:09:12.162307 0.127379 tcp 10.0.2.112 49955 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:12:24.185552 3.002219 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:12:31.193637 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:12:39.194887 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:12:55.197874 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:13:27.203949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:19:31.209779 3.001865 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:19:38.217360 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:19:46.218596 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:20:02.221673 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:20:34.227981 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:26:38.234084 3.021231 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:26:45.251249 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:26:53.252842 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:27:09.255891 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:27:41.261852 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:33:45.267859 3.042033 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:33:52.288875 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:34:00.286817 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:34:11.194653 0.000040 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:34:11.194757 0.130629 tcp 10.0.2.112 49956 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:34:11.349126 0.108759 tcp 10.0.2.112 49957 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:34:16.290247 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:34:48.295892 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:40:52.303207 3.030297 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:41:00.026257 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:41:08.120325 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:41:23.920070 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:41:55.546205 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:47:59.596035 3.029498 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:48:06.691154 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:48:14.588926 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:48:30.393129 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:49:02.373266 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:55:06.379385 3.028472 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:55:13.397344 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:55:21.398985 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:55:37.401206 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:56:09.407832 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:02:13.415464 3.000457 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:02:20.420769 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:02:28.422777 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:02:44.425827 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:03:16.431274 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:04:11.202519 0.000084 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:04:11.202687 0.114891 tcp 10.0.2.112 49958 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:04:11.340828 0.145147 tcp 10.0.2.112 49959 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:09:20.438081 3.011358 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:09:27.454612 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:09:35.456285 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:09:51.459696 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:10:23.466462 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:16:27.472060 3.010987 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:16:34.489503 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:16:42.491118 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:16:58.493645 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:17:30.499871 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:24:26.510591 3.001599 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:24:33.517955 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:24:47.739578 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:25:05.603457 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:25:42.426552 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:31:50.616235 2.956859 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:31:57.522460 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:32:05.411631 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:32:21.185771 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:32:52.740563 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:34:21.093592 0.000053 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:34:21.093687 0.117105 tcp 10.0.2.112 49960 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:34:21.237242 0.105963 tcp 10.0.2.112 49961 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:38:51.624669 2.957734 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:38:58.535463 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:39:06.422342 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:39:22.201530 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:39:53.758623 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:45:53.097873 3.004003 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:46:00.107671 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:46:08.109323 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:46:24.112230 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:46:56.118372 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:53:00.125005 3.000974 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:53:07.131749 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:53:15.133456 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:53:31.136241 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:54:03.142480 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:00:07.149480 3.000662 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:00:14.156042 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:00:22.157183 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:00:38.160096 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:01:10.166264 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:04:11.659100 0.154974 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:04:11.814215 0.108838 tcp 10.0.2.112 49962 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:04:11.947588 0.117410 tcp 10.0.2.112 49963 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:04:18.454531 0.013915 udp 10.0.2.112 53153 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V2-DNS 1970/01/07 23:04:18.469159 0.125465 tcp 10.0.2.112 49964 -> 37.19.5.65 80 FSPA* 0 0 13 5650 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:07:14.173745 3.009994 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:07:21.189408 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:07:29.191983 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:07:45.194146 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:08:17.200268 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:14:21.207464 3.000531 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:14:28.213543 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:14:36.215147 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:14:52.218479 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:15:24.224266 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:21:28.230702 3.001122 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:21:35.237464 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:21:43.238940 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:21:59.241949 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:22:31.248164 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:28:35.254677 3.001918 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:28:42.262196 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:28:50.263801 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:29:06.266099 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:29:38.271826 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:34:11.667307 0.000080 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:34:11.667467 0.115571 tcp 10.0.2.112 49965 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:34:11.812793 0.139561 tcp 10.0.2.112 49966 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:35:42.277385 3.002388 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:35:49.285442 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:35:57.286851 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:36:13.294574 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:36:45.296009 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:43:11.060839 2.961587 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:43:17.974635 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:43:25.875060 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:43:41.665065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:44:13.241860 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:50:12.382158 2.956720 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:50:19.289341 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:50:27.185360 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:50:42.966101 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:51:14.544396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:57:13.631611 2.962688 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:57:20.543040 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:57:28.435169 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:57:44.219753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:58:15.779326 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:04:14.889691 2.957847 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:04:16.165933 0.000069 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:04:16.166087 0.115283 tcp 10.0.2.112 49967 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:04:16.314004 0.117798 tcp 10.0.2.112 49968 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:04:21.804189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:04:29.705989 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:04:45.483037 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:05:17.050187 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:11:17.409352 3.010599 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:11:24.425488 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:11:32.426883 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:11:48.430102 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:12:20.435913 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:18:24.441992 3.062845 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:18:31.485443 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:18:39.464575 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:18:55.463830 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:19:27.470012 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:25:31.474821 3.023606 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:25:38.492701 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:25:46.494901 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:26:02.497809 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:26:34.506592 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:32:38.510066 3.011396 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:32:45.527252 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:32:53.529195 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:33:09.531863 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:33:41.537773 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:34:11.682458 0.000081 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:34:11.682621 0.106245 tcp 10.0.2.112 49969 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:34:11.813364 0.114776 tcp 10.0.2.112 49970 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:39:46.344855 3.011473 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:39:53.365329 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:40:01.363840 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:40:17.367630 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:40:49.373578 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:46:54.380547 3.011540 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:47:01.397640 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:47:09.401497 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:47:25.402336 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:47:57.410766 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:54:01.413757 3.258604 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:54:08.643544 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:54:16.564496 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:54:32.435944 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:55:04.452268 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:01:08.459644 3.011994 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:01:15.475753 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:01:23.477628 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:01:39.484381 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:02:11.485740 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:04:12.493194 0.000082 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:04:12.493386 0.116928 tcp 10.0.2.112 49971 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:04:12.640219 0.117470 tcp 10.0.2.112 49972 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:08:15.492371 3.011859 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:08:22.509829 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:08:30.514310 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:08:46.514178 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:09:18.520857 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:15:22.526159 3.001789 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:15:29.533645 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:15:37.535288 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:15:53.538320 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:16:25.544049 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:22:29.553013 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:23:01.870610 2.712450 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/08 01:23:08.522729 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:23:16.404088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:23:32.158558 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:24:03.659285 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:30:02.093770 2.949723 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:30:08.995781 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:30:16.874579 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:30:32.625945 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:31:04.145243 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:34:33.786789 0.000066 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:34:33.786931 0.125093 tcp 10.0.2.112 49973 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:34:33.935821 0.117204 tcp 10.0.2.112 49974 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:37:02.583753 2.955747 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:37:09.479754 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:37:17.369650 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:37:33.131160 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:38:04.646241 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:44:03.082474 2.954207 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:44:09.979539 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:44:17.856088 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:44:33.603396 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:45:05.136550 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:51:03.566090 2.974077 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:51:10.486292 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:51:18.360402 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:51:34.111667 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:52:05.615615 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:58:04.700237 3.001577 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:58:11.707431 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:58:19.709357 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:58:35.712597 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:59:07.718114 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:04:12.507847 0.000069 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:04:12.507990 0.143822 tcp 10.0.2.112 49975 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:04:12.674251 0.108248 tcp 10.0.2.112 49976 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:05:11.724398 3.001436 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:05:51.034189 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:05:58.914343 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:06:14.676395 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:06:46.205470 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:12:44.642792 2.990624 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:12:51.574629 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:12:59.446567 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:13:15.203256 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:13:46.716065 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:19:45.171649 2.952924 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:19:52.069036 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:19:59.950449 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:20:15.705038 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:20:47.213985 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:26:45.645905 2.953637 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:26:52.547186 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:27:00.424855 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:27:16.183622 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:27:47.697846 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:33:46.151801 3.003378 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:33:53.098293 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:34:00.983194 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:34:16.751244 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:34:18.384171 1.377514 arp 10.0.2.112 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:34:19.761855 0.158672 tcp 10.0.2.112 49977 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:34:19.943907 0.115076 tcp 10.0.2.112 49978 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:34:49.649051 0.000000 udp fe80::1daf:d1a3:4b5:ff61 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background